Libxml2 is the XML C parser and toolkit developed for the Gnome project (but
usable outside of the Gnome platform). XML itself is a metalanguage to design
markup languages, i.e. text language where semantic and structure are added to
the content using extra "markup" information enclosed between angle brackets.
===> The following configuration options are available for libxml2-2.15.4:
ICU=off: Unicode support via ICU
MANPAGES=off: Build and/or install manual pages
READLINE=on: History for xmllint
STATIC=on: Build static executables and/or libraries
THREAD_ALLOC=off: Per-thread memory (DEVELOPERS ONLY!)
====> Enable legacy API compatibility
HTTP=on: HTTP support
ZLIB=on: zlib compression support
===> Use 'make config' to modify these settings
textproc/libxml2: bump PORTREVISION to force rebuild
FreeBSD-ports-latest - for FreeBSD 15 - currently carries packages
that have the libxml2-core package as a dependency (and the
libxml2-core).
Bump PORTREVISION to force the package builder to resynch onto ports
where there is no libxml2-core package, to reduce confusion.
(2026Q1 is unaffected, it did not have this change.)
textproc/libxml2: really update to 2.15.1
Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/blob/2.15/NEWS
Notably, all documentation generation requires a circular dependency
on textproc/libxslt. While the API documentation, in HTML, lives
on the upstream site [0], the man pages are now pre-rendered manually.
Also includes an upstream commit addressing unsafe pointer usage
in XPath, leading to security bugs in consumers like libxslt
(CVE-2025-10911). [1]
Mark the -python child port DEPRECATED without expiration date since
upstream has not provided a firm one yet, particularly the release
schedule for the next major version 2.16.
[0] https://gnome.pages.gitlab.gnome.org/libxml2/html/index.html
[1]
https://gitlab.gnome.org/GNOME/libxml2/-/commit/0e50b31902cdb1eb242eb361c123e9e033b2af87
Event: Snowstorm Special January 2026
With hat: desktop
PR: 291316
Revert "textproc/libxml2*: update to 2.15.1, split -core"
The design of this update was repeatedly rejected in the linked PR
with a prescribed different design. This commit is therefore
unauthorised.
This reverts commit 099bd713e09ebdd02d73fde770c50706f980404f.
With hat: desktop (textproc/libxml2), gnome (USES=gnome)
PR: 291316
textproc/libxml2*: update to 2.15.1, split -core
libxml2 now requires xsltproc from libxslt to build,
yet libxslt depends on libxml2,
so we need to break a dependency cycle.
documentation needed to be split out to a separate port.
libxml2 has therefore been split into two ports,
* libxml2 builds the documentation (unless disabled),
* library and executables in libxml2-core.
Pull in one contributor patch suggested by the former libxml2 maintainer
to address one downstream security issue in recent libxslt versions.
This should address arrowd@'s hint that installing libxml2 should
provide a full-featured package.
While here, deprecate libxml2-python according to upstream plans, we
have very few users in the ports tree, and expire end of 2026Q1.
PR: 291316
textproc/libxml2: Fix cmake file
The port's cmake file is wrong because there is an unclosed
if-statement.
Can check with 'cmake -P test-libxml2.cmake' where the content of
test-libxml2.cmake is:
include("/usr/local/lib/cmake/libxml2/libxml2-config.cmake")
The test's result is:
CMake Error at /usr/local/lib/cmake/libxml2/libxml2-config.cmake:53 (if):
Flow control statements are not properly nested.
Call Stack (most recent call first):
test-libxml2.cmake:1 (include)
Approved by: portmgr (blanket, trivial runtime fix)
textproc/libxml2: update to 2.14.4
Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.14.4/NEWS
textproc/py-libxml2 child port is moved to textproc/libxml2-python
to match the Python package name upstream specified; it now USES=python
to build after do-configure. Consumers adjusted to match.
Includes two bug-fix commits.
PR: 279705
Revert "textproc/libxml2: Update to 2.14.4"
Commit goes way beyond strictly security purposes and is not approved
by desktop@.
PR: 279705
This reverts commit a18dfb61a2c96a01f9536d70ad0f69390981833d.
Mk/bsd.sites.mk: Simplify MASTER_SITES= GNOME
Since GNOME changes their numbering, in some Makefile MASTER_SITES= GNOME is
more complex. This patch simplify for users.
Differential Revision: https://reviews.freebsd.org/D43183
textproc/py-pylibxml2: rm patch that scans garbage
Remove a local patch that scans stack garbage for a pattern and then uses
the pointer after the array has been filled with actual data. This can
cause random segfaults.
The patch is under textproc/libxml2, but the patched file is only used by
textproc/py-pylibxml2.
The UTF-8 issue this was intended to fix was fixed upstream in a more
comprehensive way in 2.11.0 with this commit:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/76c6da420923f2721a2e16adfcef8707a2454a1b
PR: 286439279034
Approved by: desktop (makc)
Tested by: vvd
MFH: 2025Q2
py-libxml2: Byte compile
This eliminates annoying fs-violation errors, notably from
textproc/itstool and textproc/gtk-doc where the byte code is generated
at build time instead of already having been generated by py-libxml2.
It is still peculiar to me that these files are dumped directly into
PYTHON_SITELIBDIR and don't have a subdirectory of their own.
Worth investigating, but hierachical changes are obviously more
intrusive and beyond this scope.
textproc/libxml2: fix build with lld 17
Many symbols in the linker version script libxml2.syms are only defined
when --with-xptr-locs is enabled at configure time. Since version
scripts do not support conditionals, suppress errors with lld >= 17 due
to these undefined symbols.
PR: 273789
MFH: 2023Q3
Approved by: blanket (for desktop and kde)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
textproc/{,py-}libxml2: switch back to autotools
See notes in Makefile and linked PRs.
While here, disable the ICU option by default. CFLAGS for libicu
are passed to libxml2's consumers when the option is enabled. As
icu's API is not stable between versions, PORTREVISION bumps can
get missed.
Additionally, properly exclude all OPTIONS from py-libxml2 and
prevent do-configure from unnecessarily running.
Co-authored-by: diizzy
PR: 262853, 262940, 262877
Approved by: fluffy (mentor)
textproc/libxml2: Update to 2.9.13 and migrate to CMake
Depend on ICU and (lib)readline to follow other distros
Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.9.13
I'd like to thank both tcberner and mandree for reviewing,
suggesting improvements and helping out in general. I'd also like
thank antoine for doing exp-runs.
PR: 262288
Reviewed by: tcberner, mandree
Approved by: desktop (tcberner)
Differential Revision: https://reviews.freebsd.org/D34338
Exp-run by: antoine
textproc/libxml2: add upstream fix for CVE-2021-3541
This is relapted to parameter entities expansion and following
the line of the billion laugh attack. Somehow in that path the
counting of parameters was missed and the normal algorithm based
on entities "density" was useless.
PR: 256094
Obtained
from: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
Security: CVE-2021-3541
textproc/libxml2: fix build with VALIDATION option off
Grab two commits from upstream that fix the build when
--no-valid is passed to configure; in the ports build
that translates to the VALIDATION option turned off.
These come straight from GNOME GitLab, although I've
bunged them into one patch-* file.
Not bumping PORTREVISION, since with this option off
it would never have built, and with the option on
the resulting package is unchanged.
PR: 253596
textproc/libxml2: rename VALID option to VALIDATION
- The option name could under some circumctances lead to issues
with the VALID_CATEGOIRES variable of the ports framework.
- Simply rename the option, to something similar.
PR: 252933
Submitted by: andrew@tao11.riddles.org.uk
textproc/libxml2: ship patches via files/ due to gitlab
- gitlab has a tendency to change checksum of patches due to metadata changes
- switch to including the patches in the tree directly instead of using
PATCH_FILES
PR: 251040
Submitted by: daniel.engberg.lists@pyret.net
Reported by: David Armstrong <bink19th@pm.me>
textproc/libxml2: backport python 3.9.x support
No PORTREVISION bump, py-libxml2 was always unbuildable with py39
With hat: desktop
Obtained from: libxml2 repo
In preparation of the update of glib remove the -reference ports
Those ports mainly concern old Gnome2 libraries, the behaviour of this infra
is not compatible with the meson build system (being used in newer version)
the documentation is provided otherwise in the other version
Create desktop@ as maintainer of some shared desktop ports
This idea has been around for quite some time. Time to make it happen.
In order to share the load on the ports required by multiple desktop
environments start to share the responsibility of maintainership.
This is the initial list that came to mind, but we can probably extend it, to
include another handful of ports.
WWW: https://wiki.freebsd.org/DesktopTeam
Mailing List: https://lists.freebsd.org/mailman/listinfo/freebsd-desktop
Approved by: swills, kwm (gnome), madpilot (xfce)
Differential Revision: https://reviews.freebsd.org/D22389
Prepare for powerpc-on-clang by deleting hard-coded tests for libstdc++.so
as a stand-in for "are we running on gcc".
For people already testing powerpc on clang, it is possible that they
already have both compilers in base. Thus, the assumption that "gcc is
in base" (e.g. libstdc++.so exists) always means "force use of GCC" is
already broken. It will be for everyone on -CURRENT once the switch is
made.
Tested on both amd64 and powerpc64.
PR: 239153
Approved by: gnome (maintainer-timeout, > 1 month)
Remove usage of _PyVerify_fd().
This function appears to be removed in python 3.5.0. Instead of adding a
version check like the submitter proposed. Grab the upstream patch instead
that just removes the function usage.
PR: 224902
Submitted by: Michael Zhilin <mizhka@gmail.com>
Obtained from: libxml2 upstream
textproc/libxml2: remove LICENSE block to unbreak libxml2-reference
The addition of the MIT licence block broke at least the
textproc/libxml2-reference port due to how the helper script
bsd.gnome-reference.mk works. Removed at the request of person that
suggested the license be added [2].
PR: 209806
PR: 212265 [2]
Reported by: cpm
New release to fix a number of CVE's.
CVE-2015-1819 is also listed in the release notes of 2.9.3 but that issue
was fixed in a previous commit and documented in another vuxml entry.
MFH: 2015Q4
Security: e5423caf-8fb8-11e5-918c-bcaec565249c
patch-parser.c:
Replace allready applied patch with new patch from upstream to unbreak the
xmlcatalog command.
patch-uri.c:
Revert uri.c commit that causes the document chain to fail.
Reported by: antoine@
Tested by: bapt@
MFH: 2014Q4
When linking a library libA with a library libB using libtool, if libB.la
exists, libtool will add all libraries libB.la refers to (dependency_libs
field) to the linker command line and store them in the dependency_libs
field of libA.la. So everything that subsequently links with libA will also
link to these extra libraries. This causes too much overlinking.
This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging. However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.
So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).
(Only the first 15 lines of the commit message are shown above )
The FreeBSD x11@ and graphics team proudly presents
a zeising, kwm production, with help from dumbbell, bdrewery:
NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE
This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.
This patch also contains updates of libxcb and related ports, pixman, as well
(Only the first 15 lines of the commit message are shown above )
Introduce variable ICONV_PREFIX at Mk/Uses/iconv.mk. The default for
pre 100043 is ${LOCALBASE} and /usr otherwise. Convert all ports to
new variable usage.
Approved by: portmgr (bapt, implicit)
Update to 2.8.0. [1]
Add patch to fix CVE-2013-0338 and CVE-2013-0339. [2]
Convert to OptionsNG, rename patches to standard form. [1]
Notified by: swills@ [2]
Obtained from: gnome team repo [1]
Security: 843a4641-9816-11e2-9c51-080027019be0
- Revert previous change to add -pthread since libxml2 is not threaded, but is
thread-safe, so -pthread is not needed here, but in threaded programs that
use libxml2
Pointed out by: ale@
Discussed with: marcus, kwm
Pointyhat to: swills
- Build with -pthread and include -pthread in xml2-config --libs output when
threads are enabled
PR: ports/171353
Discussed with: marcus, kwm
Approved by: marcus
