From 4741a49553d418e4eb2ac2214254a1fd9d9e70da Mon Sep 17 00:00:00 2001
From: Daniel Cheng <dcheng@chromium.org>
Date: Thu, 21 May 2026 10:46:29 -0700
Subject: [PATCH] Roll src/third_party/expat/src/ f31adfd58..9bdfbc77e (103 commits)

https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git/+log/f31adfd584b7..9bdfbc77e335

$ git log f31adfd58..9bdfbc77e --date=short --no-merges --format='%ad %ae %s'
2026-05-09 tsomanna Add Windows ARM64 Workflow
2026-05-08 sebastian Changes: Document CVE-TODO
2026-03-08 sebastian lib: Leverage ELEMENT_TYPE.defaultAttsNames for attribute collision detection
2026-03-08 sebastian lib: Introduce ELEMENT_TYPE.defaultAttsNames
2026-03-08 sebastian lib: Extract a constant for upcoming reuse
2026-04-13 sebastian tests: Make counting_start_element_handler enforce complete attribute lists
2026-04-20 sebastian tests: Define .attributes the first time around
2026-03-13 berkay.ueruen test(attlist): Cover duplicate attribute names
2026-03-13 berkay.ueruen Make "counting_start_element_handler" count default attrs
2026-05-02 matthew.fernandez xmlwf: remove a magic number
2026-05-02 matthew.fernandez xmlwf: remove a no-op cast
2026-04-30 sebastian wasi_sdk.yml: Extract variable `${wasi_sdk_minor}`
2026-04-30 sebastian wasi_sdk.yml: Bump WASI SDK from 32 to 33
2026-04-27 sebastian Cover compilation with Visual Studio 18 2026
2026-04-27 matthew.fernandez xmlwf: Drop casts around `XML_GetUserData` that C99 does not need
2026-04-27 matthew.fernandez tests: Drop casts around `XML_GetUserData` that C99 does not need
2026-04-27 matthew.fernandez xmlwf: Drop casts around `userData` that C99 does not need
2026-04-27 matthew.fernandez xmlwf: Drop casts around `qsort` that C99 does not need
2026-04-27 matthew.fernandez tests: Drop casts around `expat_malloc` that C99 does not need
2026-04-27 matthew.fernandez tests: Drop casts around `calloc` that C99 does not need
2026-04-27 matthew.fernandez tests: Drop casts around `realloc` that C99 does not need
2026-04-27 matthew.fernandez tests: Drop casts around `malloc` that C99 does not need
2026-04-27 matthew.fernandez xmlwf: Drop casts around `malloc` that C99 does not need
2026-04-23 sebastian Set release date for 2.8.0
2026-04-23 sebastian Bump version to 2.8.0
2026-04-23 sebastian Bump version info from 12:3:11 to 13:0:12
2026-04-23 sebastian Changes: Document changes in Expat 2.8.0
2026-04-23 sebastian Sync file headers
2026-04-23 sebastian Target release 2.8.0 rather than 2.7.6
2026-04-23 sebastian perl-integration.yml: Bump to XML::Parser 2.58
2026-04-23 sebastian lib: Clean up entropy extractor includes
2026-04-21 sebastian lib: Make bool-like entropy extractors return actual `bool`
2026-04-21 matthew.fernandez lib: Fix header comment typo
2026-04-20 sebastian Improve checks for arc4random (e.g. for modern glibc)
2026-04-20 sebastian lib: Extract new files for `arc4random_buf` entropy extraction code
2026-04-20 sebastian CMake: Add switches `EXPAT_WITH_ARC4RANDOM` and `EXPAT_WITH_ARC4RANDOM_BUF`
2026-04-20 sebastian CMake: Report on arc4random and arc4random_buf use
2026-04-20 sebastian CMake: Mark all entropy source related flags as "advanced"
2026-04-20 sebastian CMake: Move `mark_as_advanced` call closer to its related definition
2026-04-20 sebastian configure.ac: Add --without-arc4random and --without-arc4random-buf
2026-04-20 sebastian configure.ac: Report on entropy source availability
2026-04-20 sebastian configure.ac: Be helpful about next steps
2026-04-20 sebastian configure.ac: Fix syntax of C test for `getentropy`
2026-04-20 49699333+dependabot[bot] Actions(deps): Bump vmactions/freebsd-vm from 1.4.4 to 1.4.5
2026-04-20 49699333+dependabot[bot] Actions(deps): Bump vmactions/solaris-vm from 1.3.2 to 1.3.3
2026-04-18 matthew.fernandez lib: Avoid assuming `uint8_t` is a character type
2026-04-08 sebastian Changes: Document CVE-2026-41080 and better protection against hash flooding
2026-04-08 sebastian doc: Document `XML_SetHashSalt` as being deprecated
2026-04-08 sebastian tests: Add basic coverage to `XML_SetHashSalt16Bytes`
2026-04-08 sebastian lib: Include `XML_SetHashSalt*` with entropy debugging
(...)
2026-04-08 sebastian lib: Introduce internal flag `m_hash_secret_salt_set`
2026-04-08 sebastian lib: Extract 16 bytes of entropy (instead of 4 to 8) for hash flooding protection
2026-04-08 sebastian lib: Drop unneeded `void *` casts in function `generate_hash_secret_salt`
2026-04-08 sebastian lib: Migrate hash salt storage to larger `struct sipkey`
2026-04-08 sebastian lib: Drop unused parameter from function `generate_hash_secret_salt`
2026-04-08 sebastian lib: Inline function `get_hash_secret_salt`
2026-04-16 sebastian CMake: Inline variable `_EXPAT_TEST_TARGETS`
2026-04-16 sebastian Stop duplicating C tests 1:1 as C++ ("runtests_cxx")
2026-04-15 sebastian memory-sanitizer-blacklist.txt: Fix `writeRandomBytes_getrandom_nonblock` reference
2026-04-15 sebastian lib: Help clang-tidy with `arc4random`, `arc4random_buf` and `rand_s`
2026-04-15 sebastian lib: Stop defining macro `LOAD_LIBRARY_SEARCH_SYSTEM32`
2026-04-16 sebastian CMake: Fix /dev/urandom reference in status output
2026-04-15 sebastian lib: Extract new files from /dev/urandom entropy extraction code
2026-04-15 sebastian lib: Extract new files from `getrandom` entropy extraction code
2026-04-15 sebastian lib: Extract new files from `arc4random` entropy extraction code
2026-04-15 sebastian lib: Extract new files from `rand_s` entropy extraction code
2026-04-15 sebastian lib/random_getentropy.h: Resolve uneeded include to expat_config.h
2026-04-15 matthew.fernandez lib/xmlparse.c: Fix interpretation of 'errno' after 'read' of urandom
2026-04-15 matthew.fernandez lib/xmlparse.c: Fix interpretation of 'errno' after 'getrandom'
2026-04-15 matthew.fernandez Build warning-free with -Wdiscarded-qualifiers -Wwrite-strings
2026-04-15 matthew.fernandez lib/xmlparse.c: Fix grammar in error message
2026-04-15 matthew.fernandez lib/xmlparse.c: Avoid propagating /dev/urandom FD to children
2026-04-13 49699333+dependabot[bot] Actions(deps): Bump actions/upload-artifact from 7.0.0 to 7.0.1
2026-04-09 sebastian perl-integration.yml: Bump to XML::Parser 2.57
2026-04-02 sebastian Add support for entropy source `getentropy(3)`
2026-04-02 sebastian CMake: Get entropy source guards to agree on `if(NOT WIN32)`
2026-04-02 sebastian emscripten.yml: Address CMake warning about not building a shared library
2026-04-04 sebastian wasi_sdk.yml: Resolve workaround for WASI SDK 32
2026-04-04 sebastian wasi_sdk.yml: Make -Werror work for WASI SDK 32
2026-04-03 sebastian wasi_sdk.yml: Extract variables ${wasi_sdk_major}
2026-04-03 sebastian wasi_sdk.yml: Bump to WASI SDK 32
2026-04-02 sebastian perl-integration.yml: Bump to XML::Parser 2.56
2026-04-01 sebastian perl-integration.yml: Bump to XML::Parser 2.55
2026-03-30 49699333+dependabot[bot] Actions(deps): Bump vmactions/freebsd-vm from 1.4.3 to 1.4.4
2026-03-27 sebastian COPYING: Bump year to 2026
2026-03-27 sebastian perl-integration.yml: Bump to XML::Parser 2.54
2026-03-27 sebastian fuzzing.yml: For concurrency, rely on GNU parallel rather than libfuzzer
2026-03-26 sebastian fuzzing.yml: Cut down folder name from "corpus" to "c"
2026-03-26 sebastian fuzzing.yml: Include public corpus of xml_lpm_fuzzer with regression testing
2026-03-26 sebastian perl-integration.yml: Bump to XML::Parser 2.53
2026-03-26 sebastian autotools: Sync CMake templates with CMake 4.3.0 for macOS
2026-03-25 sebastian tests/nsalloc_tests.c: Turn a test function name to to all-lowercase
2026-03-25 sebastian tests/nsalloc_tests.c: Be explicit about ignored return value
2026-03-23 sebastian Sync file headers
2026-03-22 sebastian .mailmap: Add Christian Ng
2026-03-21 49699333+dependabot[bot] Actions(deps): Bump microsoft/setup-msbuild from 2.0.0 to 3.0.0
2026-03-21 sebastian perl-integration.yml: Bump to XML::Parser 2.51
2026-03-21 sebastian windows-binaries.yml: Fix Inno Setup 6.1.2 download URL
2026-03-21 sebastian windows-binaries.yml: Drop accidental whitespace
2026-03-19 sebastian perl-integration.yml: Cover Perl XML::Parser before and after use of AI

Manual fixes:
- update instructions and roll script to pass additional flags to
  disable arc4random(), arc4random_buf(), and getentropy() entropy
  sources
- update BUILD.gn to include source files for entropy functions that
  were factored out of xmlparse.c
- delete no-longer-needed local patch

Bug: 514338102
Change-Id: I2ffcdb2ef2677e11eb407c431993c03250e1faf9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7861398
Reviewed-by: Dominik Röttsches <drott@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634398}
---

diff --git a/DEPS b/DEPS
index 9d174a9f..a898fb53 100644
--- a/DEPS
+++ b/DEPS
@@ -447,7 +447,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libexpat
   # and whatever else without interference from each other.
-  'libexpat_revision': 'f31adfd584b7f6c50bbf4d22eb928538ffc9145a',
+  'libexpat_revision': '9bdfbc77e3355405ceefbe59420abed953a5657e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling jetstream-main
   # and whatever else without interference from each other.
diff --git a/third_party/expat/0001-Do-not-claim-getrandom.patch b/third_party/expat/0001-Do-not-claim-getrandom.patch
deleted file mode 100644
index 6841a521..0000000
--- a/third_party/expat/0001-Do-not-claim-getrandom.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/third_party/expat/include/expat_config/expat_config.h b/third_party/expat/include/expat_config/expat_config.h
-index bc83d399214ed..81d6af75a6467 100644
---- a/third_party/expat/include/expat_config/expat_config.h
-+++ b/third_party/expat/include/expat_config/expat_config.h
-@@ -14,7 +14,7 @@
- /* #undef HAVE_ARC4RANDOM */
-
- /* Define to 1 if you have the `arc4random_buf' function. */
--#define HAVE_ARC4RANDOM_BUF 1
-+/* #define HAVE_ARC4RANDOM_BUF 1 */
-
- /* define if the compiler supports basic C++11 syntax */
- #define HAVE_CXX11 1
diff --git a/third_party/expat/BUILD.gn b/third_party/expat/BUILD.gn
index 720f1d1..9ad36d4 100644
--- a/third_party/expat/BUILD.gn
+++ b/third_party/expat/BUILD.gn
@@ -66,8 +66,10 @@
       # expat expects to define WIN32_LEAN_AND_MEAN itself
       configs -= [ "//build/config/win:lean_and_mean" ]
       defines += [ "COMPILED_FROM_DSP" ]
+      sources += [ "src/expat/lib/random_rand_s.c" ]
     } else {
       defines += [ "HAVE_EXPAT_CONFIG_H" ]
+      sources += [ "src/expat/lib/random_dev_urandom.c" ]
     }
   }
 }
diff --git a/third_party/expat/README.chromium b/third_party/expat/README.chromium
index 24b4d539..1e5a809 100644
--- a/third_party/expat/README.chromium
+++ b/third_party/expat/README.chromium
@@ -1,10 +1,10 @@
 Name: Expat XML Parser
 Short Name: expat
 URL: https://github.com/libexpat/libexpat
-Version: R_2_7_5-0-gf31adfd5
-CPEPrefix: cpe:/a:libexpat_project:libexpat:2.7.5
-Date: 2026-03-19
-Revision: f31adfd584b7f6c50bbf4d22eb928538ffc9145a
+Version: R_2_8_0-29-g9bdfbc77
+CPEPrefix: cpe:/a:libexpat_project:libexpat:2.8.0
+Date: 2026-05-20
+Revision: 9bdfbc77e3355405ceefbe59420abed953a5657e
 Update Mechanism: Manual
 Security Critical: yes
 Shipped: yes
@@ -22,17 +22,12 @@
   roll-dep --roll-to origin/upstream/master src/third_party/expat/src/
   cd $CHROMIUM_SRC/third_party/expat/src/expat
   ./buildconf.sh
-  ./configure --without-getrandom --without-sys-getrandom
+  ./configure --without-arc4random --without-arc4random-buf --without-getentropy --without-getrandom --without-sys-getrandom
   cp expat_config.h $CHROMIUM_SRC/third_party/expat/include/expat_config/
   cd $CHROMIUM_SRC/third_party/expat