NEWS file for libxml2

v2.11.4: May 18 2023

Fixes a serious regression.

- parser: Fix regression when push parsing UTF-8 sequences


v2.11.3: May 11 2023

Fixes more regressions.

- xinclude: Fix false positives in inclusion loop detection
- autotools: Fix ICU detection
- parser: Fix "huge input lookup" error with push parser
- xpath: Fix build without LIBXML_XPATH_ENABLED
- hash: Fix possible startup crash with old libxslt versions
- autoconf: fix iconv library paths (Mike Dalessio)


v2.11.2: May 5 2023

Fix regressions.

- threads: Fix startup crash with weak symbol hack
- win32: Don't depend on removed .def file
- schemas: Fix memory leak in xmlSchemaValidateStream


v2.11.1: Apr 30 2023

Fixes build and ABI issues.

- cmake: Fix va_copy detection (Luca Niccoli)
- libxml.m4: Fix quoting
- Link with --undefined-version
- libxml2.syms: Revert removal of version information


v2.11.0: Apr 28 2023

### Major changes

Protection against entity expansion attacks, also known as "billion laughs"
has been greatly improved. Malicious files should be detected reliably now
and false positives should be reduced. It is possible though that large
documents which make heavy use of entities are rejected now.

This release finally fixes symbol visibility on UNIX systems. Internal
symbols will now be hidden. While these symbols were never declared in public
headers, it was still possible to declare them manually. Now this won't work.

All symbol information has been removed from the ELF version script to fix
link errors with --no-undefined-version. The version nodes are kept so it
should still be possible to run binaries linked against older versions.

About 90 memory errors in code paths handling malloc failures have been fixed.
While these issues shouldn't impact security, this improves robustness under
memory pressure.

The XInclude engine has been reworked to properly support nested includes.

Several cases of quadratic behavior in the XML push parser have been fixed.

Refactoring has begun on some buffering and encoding code with the goal of
simplifying this part of the code base and improving error reporting.

Other highlights:

- Consolidated private header files.
- Major rework of the autoconf build.
- Deprecated several outdated and internal functions.

Special thanks to Google's Open Source Security Subsidies program for
sponsoring much of the work on this release!

Ongoing work on libxml2 relies on funding. For a list of important open
issues see <https://gitlab.gnome.org/GNOME/libxml2/-/issues/507>

### Security

- Fix use-after-free in xmlParseContentInternal() (David Kilzer)
- xmllint: Fix use-after-free with --maxmem
- parser: Fix OOB read when formatting error message
- entities: Rework entity amplification checks

### Regressions

- parser: Fix regression in xmlParserNodeInfo accounting

### Bug fixes

- Fix memory errors in code handling malloc failures
- encoding: Fix error code in asciiToUTF8
- xpath: number('-') should return NaN
- xmlParseStartTag2() contains typo when checking for default definitions for
  an attribute in a namespace (David Kilzer)
- uri: Fix handling of port numbers
- error: Make sure that error messages are valid UTF-8
- xinclude: Fix nested includes

### Improvements

- xmllint: Validate --maxmem integer option
- xmlValidatePopElement() can return invalid value (-1) (David Kilzer)
- parser: Rework EBCDIC code page detection
- parser: Limit name length in xmlParseEncName
- parser: Rework shrinking of input buffers
- html: Rely on CUR_CHAR to grow the input buffer
- parser: Rely on CUR_CHAR/NEXT to grow the input buffer
- valid: Make xmlValidateElement non-recursive
- html: Fix quadratic behavior in htmlParseTryOrFinish
- xmllint: Fix memory leak with --pattern --stream
- parser: Stop calling xmlParserInputShrink
- html: Impose some length limits
- valid: Allow xmlFreeValidCtxt(NULL)
- parser: Stop calling xmlParserInputGrow
- xinclude: Fix quadratic behavior in xmlXIncludeLoadTxt
- xinclude: Abort immediately if max depth was exceeded
- xpath: Only report the first error
- error: Don't move past current position
- error: Limit number of parser errors
- parser: Lower entity nesting limit with XML_PARSE_HUGE
- parser: Don't increase depth twice when parsing internal entities
- parser: Improve detection of entity loops
- parser: Only report a single entity error
- libxml.h: Remove dubious definition of LIBXML_STATIC
- html: Improve parsing of nested lists
- memory: Don't use locks in xmlMemUsed
- encoding: Remove unused variable xmlDefaultCharEncodingHandler
- Rework initialization code
- Add .editorconfig
- parser: Merge misc, prolog and epilog cases in push parser
- parser: Fix 'consumed' accounting when switching encodings
- html: Fix check for end of comment in push parser
- parser: Fix push parser with 1-3 byte initial chunk
- parser: Rewrite push parser boundary checks
- reader: Switch to xmlParserInputBufferCreateMem
- html: Don't escape ASCII chars in href attributes
- io: Don't shrink memory input buffers
- parser: Don't call xmlSHRINK from push parser
- parser: Ignore cdata argument in xmlParseCharData
- parser: Rework push parser parser progress checks
- io: Fix a few integer overflows in I/O statistics
- io: Rework xmlParserInputBufferGrow with encodings
- io: Remove xmlInputReadCallbackNop
- io: Check for memory buffer early in xmlParserInputGrow
- parser: Fix error message in xmlParseCommentComplex
- Bypass proxy in nanoHTTP for hosts in "no_proxy" (Markus Jörg)
- schemas: Fix infinite loop in xmlSchemaCheckElemSubstGroup
- threads: Remove check for pthread_equal
- xinclude: Rework XInclude cache
- xinclude: Remove inefficient refcounting scheme
- xmllint: Improve handling of empty XPath node sets
- parser: Fix potential memory leak in xmlParseAttValueInternal
- error: Don't use initGenericErrorDefaultFunc
- xpath: Lower XPath recursion limit on Windows
- Stop including sys/types.h
- Don't define WIN32 macro
- Make xmlNewSAXParserCtx take a const sax handler
- Consolidate private header files
- Remove internal macros from parserInternals.h
- Move some HTML functions to correct header file
- xmllint: Stop calling xmlSAXDefaultVersion
- Introduce xmlNewSAXParserCtxt and htmlNewSAXParserCtxt
- Don't mess with parser options in htmlParseDocument
- Remove useless call to htmlDefaultSAXHandlerInit
- Remove htmlDefaultSAXHandler from non-SAX1 build
- Don't initialize SAX handler in htmlReadMemory
- Fix htmlReadMemory mixing up XML and HTML functions
- Don't use default SAX handler to report unrelated errors
- Create stream with buffer in xmlNewStringInputStream
- xmlcatalog: Fix memory leaks

### Code quality

- xzlib: Fix implicit sign change in xz_open
- parser: Simplify calculation of available buffer space
- parser: Use size_t when subtracting input buffer pointers
- parser: Check for integer overflow when updating checkIndex
- xpath: Fix harmless integer overflow in xmlXPathTranslateFunction
- schematron: Use logical and
- relaxng: Remove useless if statement
- schemas: Remove useless if statement
- pattern: Merge identical branches
- regexp: Add sanity check in xmlRegCalloc2
- regexp: Simplify xmlRegAtomPush
- encoding: Cast toupper argument to unsigned char
- uri: Add explicit cast in xmlSaveUri
- buf: Fix return value of xmlBufGetInputBase
- parser: Fix integer overflow of input ID
- parser: Remove useless ent->etype test in xmlParseReference
- parser: Remove useless ent->children tests in xmlParseReference
- xmlmemory.c: Remove xmlMemContentShow
- libxml.h: Add comments and indentation
- libxml.h: Don't include stdio.h
- xmlexports.h: Disable docs for internal macro XMLPUBLIC
- parser: Simplify xmlParseConditionalSections
- io: Rearrange code in xmlSwitchInputEncodingInt
- warnings: Fix -Wstrict-prototypes warning
- warnings: Remove set-but-unused variables
- Fix compiler warnings in SAX2.c
- Fix unused variable warning in python/types.c
- Fix compiler warning in examples
- Fix compiler warnings in fuzzing code
- Remove unused code in nanohttp.c
- Remove or annotate char casts
- Don't use sizeof(xmlChar) or sizeof(char)
- Remove explicit integer casts

### Deprecations

- parser: Deprecate more internal functions
- parser: Deprecate some parser input functions
- parser: Deprecate xmlString*DecodeEntities
- threads: Deprecate some internal functions
- buf: Deprecate static/immutable buffers
- Deprecate internal parser functions
- Deprecate old HTML SAX API
- Generate deprecation warnings for old SAX API
- Mark more functions setting globals as deprecated
- Mark more parser functions as deprecated
- Mark most SAX1 functions as deprecated
- Deprecate some global variables

### Portability

- autoconf: Warn about outdated C compilers
- win32: Remove broken libxml2.def.src
- Remove symbols from version script
- catalog.c: Silence a cast warning on VS 2022 (Lukáš Tyrychtr)
- libxml.h: Remove ancient LynxOS setup
- Use python3 not python (Ross Burton)
- xstc/fixup-tests.py: port to Python 3 (Ross Burton)
- xstc/fixup-tests.py: unify whitespace (Ross Burton)
- Remove hacky heuristic from b2dc5675 (Alex Richardson)
- Avoid creating an out-of-bounds pointer by rewriting a check
  (Alex Richardson)
- Hide internal functions
- Correctly relocate internal pointers after realloc() (Alex Richardson)
- Visual Studio builds: Allow silencing deprecation warnings (Chun-wei Fan)
- Visual Studio: Define XML_DEPRECATED (Chun-wei Fan)
- xmllint: Include <io.h> on Windows
- warnings: Work around MSVC bug
- sources: Silence C4013 warnings on Visual Studio (Chun-wei Fan)
- python/setup.py.in: Improve Windows import patching (Chun-wei Fan)
- python: Create .pyd on Windows
- Fix Python build on Windows
- Fix Windows compiler warnings in python/types.c
- Fix libxml_PyFileGet
- Remove BeOS support
- Fix libxml_PyFileGet with stdout on macOS
- Migrate from PyEval_ to PyObject_
- Port build_glob.py to Python 3
- Port genChRanges.py to Python 3
- xmlexports.h: Remove LIBXML_FASTCALL optimization
- Remove XMLCALL and XMLCDECL macros from public headers
- Remove XMLDECL macro from .c files

### Build systems

- cmake: Link against `dl` and `dld` only when `LIBXML2_WITH_MODULES` is
  enabled (Alexander Kutelev)
- autotools: Fix make distcheck
- Remove RPM build, Makefile.tests, README.tests
- libxml.m4: deprecate AM_PATH_XML2, wrap PKG_CHECK_MODULES instead
  (Ross Burton)
- libxml.m4: fix -Wstrict-prototypes (Sam James)
- cmake: Build static library with -DLIBXML_STATIC
- autotools: Don't use version script on Windows
- autotools: Fix winsock detection
- autotools: Only add network libraries if HTTP/FTP enabled
- autotools: Disable parallel Python build
- python: Don't output missing generators during build
- build: Remove check for broken ss_family
- http: Simplify IPv6 checks
- autotools: Fix network checks on Windows
- Fix detection of GNU libiconv
- cmake: Fix Python installation
- cmake: Don't check for Python 2
- configure.ac: Also check for MSYS host
- Improve network library detection
- Detect ws2_32 with AC_SEARCH_LIBS
- Rework network configure checks
- Remove arg cast configure checks
- Fix dlopen check
- Remove HAVE_WIN32_THREADS configuration flag
- Rework dlopen and pthread detection
- Fix test in configure.ac
- cmake: Enable GCC compiler warnings
- Always link with -no-undefined
- Use AM_CFLAGS and AM_LDFLAGS consistently
- Remove -Wredundant-decls
- Call AC_CHECK_* with multiple arguments
- configure.ac: Remove checks for unused programs
- Rework library detection in configure.ac
- Rearrange configure.ac
- Consolidate zlib and lzma detection
- Remove "runtime debugging"
- Consolidate simple API modules in configure.ac
- Fix dependency resolution in configure.ac
- Fix --with-valid --without-regexps build
- Fix --with-schemas --without-xpath build
- Don't build unneeded .c source files
- Move xmlIsXHTML to tree.c
- Cleanup distribution settings in Makefile.am
- Also clean *.pyc files for Python 2
- Don't distribute libxml2.spec

### Tests

- testchar: Add test for memory pull parser with encoding
- fuzz: Also test init function of URI fuzzer
- fuzz: Separate fuzzer for DTD validation
- gitlab-ci: Enable all "integer" sanitizers
- fuzz: Inject random malloc failures
- fuzz: Support variable integer sizes in fuzz data
- fuzz: Fix duplicate detection in fuzzEntityRecorder
- fuzz: Set filename in xmlFuzzEntityLoader
- fuzz: Allow xmlFuzzReadString(NULL)
- fuzz: Fix Makefile dependencies
- fuzz: Add test/recurse to seed corpus
- fuzz: Add separate XInclude fuzzer
- runsuite: Some errors are expected
- testrecurse: Test entity expansion stats
- testapi.c: Initialize catalog early
- gentest.py: Fix memory leak in API tests
- tests: Enable "runsuite" test
- python/tests/reader2: use absolute paths everywhere (Ross Burton)
- python/tests/reader2: always exit(1) if a test fails (Ross Burton)
- testModule: exit if the module can't be opened (Ross Burton)
- CI: disable modules in gcc:static build (Ross Burton)
- CI: fix CI on MinGW builds (Ross Burton)
- python: Fix memory leak checks
- tests: Check that xmlInitParser doesn't allocate memory
- tests: Fix use-after-free in Python tests
- tests: Remove unneeded #includes
- gitlab-ci: Make Test-Msvc exit if ctest fails
- gitlab-ci: Treat compiler warnings as errors on MSVC
- test: Add test for push parser boundaries
- gitlab-ci: Upgrade image to Ubuntu 22.10, reenable MSan
- gitlab-ci: Reenable LeakSanitizer
- gitlab-ci: Fix llvm-symbolizer
- xinclude: Don't create result doc for test with errors
- xinclude: Also test error messages
- gitlab-ci: Allow cast-align warnings from clang
- gitlab-ci: Fix tar invocation
- gitlab-ci: Move MSVC test to separate script
- gitlab-ci: Fix SUFFIX, remove MINGW_PATH
- gitlab-ci: Consolidate CMake test scripts
- gitlab-ci: Only install MinGW autotools if needed
- gitlab-ci: Only install cmake MinGW package if needed
- gitlab-ci: Install 7-Zip using the .msi
- Use $MSYSTEM and 'bash -lc' in MinGW CI
- Add CI job for MinGW/Autotools
- Consolidate CI scripts
- Allow empty MINGW_PACKAGE_PREFIX
- Move Dockerfile to .gitlab-ci directory
- testapi: Disable on Windows for now
- Disable fuzzer tests if glob.h wasn't found
- Move automata test to runtest.c
- Fix testapi when building --without-sax1

# Documentation

- doc: Remove ancient files
- Remove ancient TODOs
- html: Fix htmlInitAutoClose documentation
- doc: Mention new location of XML catalog as breaking change
- doc: Mention potentially breaking changes in NEWS
- doc: Remove xmlDllMain from documentation and version script
- doc: Mention ${sysconfdir} in man pages
- doc: Document xmlcatalog --convert
- doc: Document xmllint --nodict and --pedantic
- doc: Fix indentation in source XML files
- xmllint: Document --quiet option
- Improve cross-references in API docs
- Improve documentation of globals
- Fix documentation parser
- Support comments for global variables in documentation
- Fix update call in apibuild.py
- Don't index anything in DOC_DISABLE sections
- Fix warnings from apibuild.py
- Start with documentation for maintainers


v2.10.4: Apr 11 2023

### Security

- [CVE-2023-29469] Hashing of empty dict strings isn't deterministic
- [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType
- schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

### Regressions

- SAX2: Ignore namespaces in HTML documents
- io: Fix "buffer full" error with certain buffer sizes


v2.10.3: Oct 14 2022

### Security

- [CVE-2022-40304] Fix dict corruption caused by entity reference cycles
- [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
- Fix overflow check in SAX2.c

### Portability

- win32: Fix build with VS2013

### Build system

- cmake: Set SOVERSION


v2.10.2: Aug 29 2022

### Improvements

- Remove set-but-unused variable in xmlXPathScanName
- Silence -Warray-bounds warning

### Build system

- build: require automake-1.16.3 or later (Xi Ruoyao)
- Remove generated files from distribution

### Test suite

- Don't create missing.xml when running testapi


v2.10.1: Aug 25 2022

### Regressions

- Fix xmlCtxtReadDoc with encoding

### Bug fixes

- Fix HTML parser with threads and --without-legacy

### Build system

- Fix build with Python 3.10
- cmake: Disable version script on macOS
- Remove Makefile rule to build testapi.c

### Documentation

- Switch back to HTML output for API documentation
- Port doc/examples/index.py to Python 3
- Fix order of exports in libxml2-api.xml
- Remove libxml2-refs.xml


v2.10.0: Aug 17 2022

### Breaking changes

The Docbook parser module and all related symbols habe been removed completely.
This was experimental code which never worked and generated a deprecation
warning for 15+ years. The library's soname wasn't changed in order to allow
seamless upgrades to later versions. If this concerns you, consider bumping
soname yourself.

Some other modules are now disabled by default and will eventually be removed
completely:

- Support for XPointer locations (ranges and points): This was based on
  a W3C specification which never got beyond Working Draft status. To my
  knowledge, there's no software supporting this spec which is still
  maintained. You now have to enable this code by passing the
  `--with-xptr-locs` configuration option. Be warned that this part of
  the code base is buggy and had many security issues in the past.

- Support for the built-in FTP client (`--with-ftp`).

- Support for "legacy" functions (`--with-legacy`).

If you're concerned about ABI stability and haven't disabled these modules
already, add the following configuration options or bump soname yourself:

    --with-ftp
    --with-legacy
    --with-xptr-locs

Several functions of the public API were deprecated. Most of them should be
completely unused and will generate a deprecation warning now.

The autoconf build now uses the sysconfdir variable for the location of
the default catalog file. The path changed from hardcoded /etc/xml/catalog
to ${sysconfdir}/xml/catalog. The sysconfdir variable defaults to
${prefix}/etc, prefix defaults to /usr/local, so without other options
the path becomes /usr/local/etc/xml/catalog. If you want the old behavior,
configure with

    --sysconfdir=/etc

### Security

- [CVE-2022-2309] Reset nsNr in xmlCtxtReset
- Reserve byte for NUL terminator and report errors consistently in xmlBuf and
  xmlBuffer (David Kilzer)
- Fix missing NUL terminators in xmlBuf and xmlBuffer functions (David Kilzer)
- Fix integer overflow in xmlBufferDump() (David Kilzer)
- xmlBufAvail() should return length without including a byte for NUL
  terminator (David Kilzer)
- Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() (David
  Kilzer)
- Use xmlNewDocText in xmlXIncludeCopyRange
- Fix use-after-free bugs when calling xmlTextReaderClose() before
  xmlFreeTextReader() on post-validating parser (David Kilzer)
- Use UPDATE_COMPAT() consistently in buf.c (David Kilzer)
- fix: xmlXPathParserContext could be double-delete in  OOM case. (jinsub ahn)

### Removals and deprecations

- Disable XPointer location support by default
- Remove outdated xml2Conf.sh
- Deprecate module init and cleanup functions
- Remove obsolete XML Software Autoupdate (XSA) file
- Remove DOCBparser
- Remove obsolete Python test framework
- Remove broken VxWorks support
- Remove broken Mac OS 9 support
- Remove broken bakefile support
- Remove broken Visual Studio 2010 support
- Remove broken Windows CE support
- Deprecate IDREF-related functions in valid.h
- Deprecate legacy functions
- Disable legacy support by default
- Deprecate all functions in nanoftp.h
- Disable FTP support by default
- Add XML_DEPRECATED macro
- Remove elfgcchack.h

### Regressions

- Skip incorrectly opened HTML comments
- Restore behavior of htmlDocContentDumpFormatOutput() (David Kilzer)

### Bug fixes

- Fix memory leak with invalid XSD
- Make XPath depth check work with recursive invocations
- Fix memory leak in xmlLoadEntityContent error path
- Avoid double-free if malloc fails in inputPush
- Properly fold whitespace around the QName value when validating an XSD
  schema. (Damjan Jovanovic)
- Add whitespace folding for some atomic data types that it's missing on.
  (Damjan Jovanovic)
- Don't add IDs containing unexpanded entity references

### Improvements

- Avoid calling xmlSetTreeDoc
- Simplify xmlFreeNode
- Don't reset nsDef when changing node content
- Fix unintended fall-through in xmlNodeAddContentLen
- Remove unused xmlBuf functions (David Kilzer)
- Implement xpath1() XPointer scheme
- Add configuration flag for XPointer locations support
- Fix compiler warnings in Python code
- Mark more static data as `const` (David Kilzer)
- Make xmlStaticCopyNode non-recursive
- Clean up encoding switching code
- Simplify recursive pthread mutex
- Use non-recursive mutex in dict.c
- Fix parser progress checks
- Avoid arithmetic on freed pointers
- Improve buffer allocation scheme
- Remove unneeded #includes
- Add support for some non-standard escapes in regular expressions. (Damjan
  Jovanovic)
- htmlParseComment: handle abruptly-closed comments (Mike Dalessio)
- Add let variable tag support (Oliver Diehl)
- Add value-of tag support (Oliver Diehl)
- Remove useless call to xmlRelaxNGCleanupTypes
- Don't include ICU headers in public headers
- Update `xmlStrlen()` to use POSIX / ISO C `strlen()` (Mike Dalessio)
- Fix unused variable warnings with disabled features
- Only warn on invalid redeclarations of predefined entities
- Remove unneeded code in xmlreader.c
- Rework validation context flags

### Portability

- Use NAN/INFINITY if available to init XPath NaN/Inf (Sergey Kosukhin)
- Fix Python tests on macOS
- Fix xmlCleanupThreads on Windows
- Fix reinitialization of library on Windows
- Don't mix declarations and code in runtest.c
- Use portable python shebangs (David Seifert)
- Use critical sections as mutex on Windows
- Don't set HAVE_WIN32_THREADS in win32config.h
- Use stdint.h with newer MSVC
- Remove cruft from win32config.h
- Remove isinf/isnan emulation in win32config.h
- Always fopen files with "rb"
- Remove __DJGPP__ checks
- Remove useless __CYGWIN__ checks

### Build system

- Don't autogenerate doc/examples/Makefile.am
- cmake: Install libxml.m4 on UNIX-like platforms (Daniel E)
- cmake: Use symbol versioning on UNIX-like platforms (Daniel E)
- Port genUnicode.py to Python 3
- Port gentest.py to Python 3
- cmake: Fix build without thread support
- cmake: Install documentation in CMAKE_INSTALL_DOCDIR
- cmake: Remove non needed files in docs dir (Daniel E)
- configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
  (Christopher Degawa)
- Move local Autoconf macros into m4 directory
- Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
- Update libxml-2.0-uninstalled.pc.in
- Remove LIBS from XML_PRIVATE_LIBS
- Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
- Don't overlink executables
- cmake: Adjust paths for UNIX or UNIX-like target systems (Daniel Engberg)
- build: Make use of variables in libxml's pkg-config file (Daniel Engberg)
- Avoid obsolescent `test -a` constructs (David Seifert)
- Move AM_MAINTAINER_MODE to AM section
- configure.ac: make AM_SILENT_RULES([yes]) unconditional (David Seifert)
- Streamline documentation installation
- Don't try to recreate COPYING symlink
- Detect libm using libtool's macros (David Seifert)
- configure.ac: disable static libraries by default (David Seifert)
- python/Makefile.am: nest python docs in $(docdir) (David Seifert)
- python/Makefile.am: rely on global AM_INIT_AUTOMAKE (David Seifert)
- Makefile.am: install examples more idiomatically (David Seifert)
- configure.ac: remove useless AC_SUBST (David Seifert)
- Respect `--sysconfdir` in source files (David Seifert)
- Ignore configure backup file created by recent autoreconf too (Vadim Zeitlin)
- Only install *.html and *.c example files
- Remove --with-html-dir option
- Rework documentation build system
- Remove old website
- Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings (David Seifert)
- Update genChRanges.py
- Update build_glob.py
- Remove ICONV_CONST test
- Remove obsolete AC_HEADER checks
- Don't check for standard C89 library functions
- Don't check for standard C89 headers
- Remove special configuration for certain maintainers

### Test suite, CI

- Disable network in API tests
- testapi: remove leading slash from "/missing.xml" (Mike Gilbert)
- Build Autotools CI tests out of source tree (VPATH)
- Add --with-minimum build to CI tests
- Fix warnings when testing --with-minimum build
- cmake: Run all tests when threads are disabled
- Also build CI tests with -Werror
- Move doc/examples tests to new test suite
- Simplify 'make check' targets
- Fix schemas and relaxng tests
- Remove unused result files
- Allow missing result files in runtest
- Move regexp tests to runtest
- Move SVG tests to runtest.c
- Move testModule to new test suite
- Move testThreads to new test suite
- Remove major parts of old test suite
- Make testchar return an error on failure (Tony Tascioglu)
- Add CI job for static build
- python/tests: open() relative to test scripts (David Seifert)
- Port some test scripts to Python 3

### Documentation

- Improve documentation of tree manipulation API
- Update xml2-config man page
- Consolidate man pages
- Rename xmlcatalog_man.xml
- Make examples a standalone HTML page
- Fix documentation in entities.c
- Add note about optimization flags


v2.9.14: May 02 2022:
   - Security:
  [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
  Fix potential double-free in xmlXPtrStringRangeFunction
  Fix memory leak in xmlFindCharEncodingHandler
  Normalize XPath strings in-place
  Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars()
    (David Kilzer)
  Fix leak of xmlElementContent (David Kilzer)

   - Bug fixes:
  Fix parsing of subtracted regex character classes
  Fix recursion check in xinclude.c
  Reset last error in xmlCleanupGlobals
  Fix certain combinations of regex range quantifiers
  Fix range quantifier on subregex

   - Improvements:
  Fix recovery from invalid HTML start tags

   - Build system, portability:
  Define LFS macros before including system headers
  Initialize XPath floating-point globals
  configure: check for icu DEFS (James Hilliard)
  configure.ac: produce tar.xz only (GNOME policy) (David Seifert)
  CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
  Fix build with older Python versions
  Fix --without-valid build


v2.9.13: Feb 19 2022:
   - Security:
  [CVE-2022-23308] Use-after-free of ID and IDREF attributes
  (Thanks to Shinji Sato for the report)
  Use-after-free in xmlXIncludeCopyRange (David Kilzer)
  Fix Null-deref-in-xmlSchemaGetComponentTargetNs (huangduirong)
  Fix memory leak in xmlXPathCompNodeTest
  Fix null pointer deref in xmlStringGetNodeList
  Fix several memory leaks found by Coverity (David King)
  
   - Fixed regressions:
  Fix regression in RelaxNG pattern matching
  Properly handle nested documents in xmlFreeNode
  Fix regression with PEs in external DTD
  Fix random dropping of characters on dumping ASCII encoded XML (Mohammad Razavi)
  Revert "Make schema validation fail with multiple top-level elements"
  Fix regression when parsing invalid HTML tags in push mode
  Fix regression parsing public IDs literals in HTML
  Fix buffering in xmlOutputBufferWrite
  Fix whitespace when serializing empty HTML documents
  Fix XPath recursion limit
  Fix regression in xmlNodeDumpOutputInternal
  Work around lxml API abuse
  
   - Bug fixes:
  Fix xmlSetTreeDoc with entity references
  Fix double counting of CRLF in comments
  Make sure to grow input buffer in xmlParseMisc
  Don't ignore xmllint options after "-"
  Don't normalize namespace URIs in XPointer xmlns() scheme
  Fix handling of XSD with empty namespace
  Also register HTML document nodes
  Make xmllint return an error if arguments are missing
  Fix handling of ctxt->base in xmlXPtrEvalXPtrPart
  Fix xmllint --maxmem
  Fix htmlReadFd, which was using a mix of xml and html context functions (Finn Barber)
  Move current position before possible calling of ctxt->sax->characters (Yulin Li)
  Fix parse failure when 4-byte character in UTF-16 BE is split across a chunk (David Kilzer)
  Patch to forbid epsilon-reduction of final states (Arne Becker)
  Avoid segfault at exit when using custom memory functions (Mike Dalessio)
  
   - Tests, code quality, fuzzing:
  Remove .travis.yml
  Make xmlFuzzReadString return a zero size in error case
  Fix unused function warning in testapi.c
  Update NewsML DTD in test suite
  Add more checks for malloc failures in xmllint.c
  Avoid potential integer overflow in xmlstring.c
  Run CI tests with UBSan implicit-conversion checks
  Fix casting of line numbers in SAX2.c
  Fix integer conversion warnings in hash.c
  Add explicit casts in runtest.c 
  Fix integer conversion warning in xmlIconvWrapper
  Add suffix to unsigned constant in xmlmemory.c
  Add explicit casts in testchar.c
  Fix integer conversion warnings in xmlstring.c
  Add explicit cast in xmlURIUnescapeString
  Remove unused variable in xmlCharEncOutFunc (David King)
  
   - Build system, portability:
  Remove xmlwin32version.h
  Fix fuzzer test with VPATH build
  Support custom prefix when installing Python module
  Remove Makefile.win
  Remove CVS and SVN-related code
  Port python 3.x module to Windows and improve distutils (Chun-wei Fan)
  Correctly install the HTML examples into their subdirectory (Mattia Rizzolo)
  Refactor the settings of $docdir (Mattia Rizzolo)
  Remove unused configure checks (Ben Boeckel)
  python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS (Sam James)
  Fix check for libtool in autogen.sh
  Use version in configure.ac for CMake (Timothy Lyanguzov)
  Add CMake alias targets for embedded projects (Markus Rickert)
  
   - Documentation:
  Remove SVN keyword anchors
  Rework README
  Remove README.cvs-commits
  Remove old ChangeLog
  Update hyperlinks
  Remove README.docs
  Remove MAINTAINERS 
  Remove xmltutorial.pdf
  Upload documentation to GitLab pages
  Document how to escape XML_CATALOG_FILES
  Fix libxml2.doap
  Update URL for libxml++ C++ binding (Kjell Ahlstedt)
  Generate devhelp2 index file (Emmanuele Bassi)
  Mention XML_CATALOG_FILES is space-separated (Jan Tojnar)
  Add documentaiton for xmllint exit code 10 (Rainer Canavan)
  Fix some validation errors in the FAQ (David King)
  Add instructions on how to use CMake to compile libxml (Markus Rickert)
  


v2.9.12: May 13 2021:
   - Build system:
  Add fuzz.h and seed/regexp to EXTRA_DIST
  


v2.9.11: May 13 2021:
   - Security:
  Patch for security issue CVE-2021-3541 (Daniel Veillard)
  
   - Documentation:
  Clarify xmlNewDocProp documentation (Nick Wellnhofer)
  
   - Portability:
  CMake: Only add postfixes if MSVC (Christopher Degawa),
  Fix XPath NaN/Inf for older GCC versions (Nick Wellnhofer),
  Use CMake PROJECT_VERSION (Markus Rickert),
  Fix warnings in libxml.m4 with autoconf 2.70+. (Simon Josefsson),
  Add CI for CMake on MSVC (Markus Rickert),
  Update minimum required CMake version (Markus Rickert),
  Add variables for configured options to CMake config files (Markus Rickert),
  Check if variables exist when defining targets (Markus Rickert),
  Check if target exists when reading target properties (Markus Rickert),
  Add xmlcatalog target and definition to config files (Markus Rickert),
  Remove include directories for link-only dependencies (Markus Rickert),
  Fix ICU build in CMake (Markus Rickert),
  Configure pkgconfig, xml2-config, and xml2Conf.sh file (Markus Rickert),
  Update CMake config files (Markus Rickert),
  Add xmlcatalog and xmllint to CMake export (Markus Rickert),
  Simplify xmlexports.h (Nick Wellnhofer),
  Require dependencies based on enabled CMake options (Markus Rickert),
  Use NAMELINK_COMPONENT in CMake install (Markus Rickert),
  Add CMake files to EXTRA_DIST (Markus Rickert),
  Add missing compile definition for static builds to CMake (Markus Rickert),
  Add CI for CMake on Linux and MinGW (Markus Rickert),
  Fix variable name in win32/configure.js (Nick Wellnhofer),
  Fix version parsing in win32/configure.js (Nick Wellnhofer),
  Fix autotools warnings (Nick Wellnhofer),
  Update config.h.cmake.in (Markus Rickert),
  win32: allow passing *FLAGS on command line (Michael Stahl),
  Configure file xmlwin32version.h.in on MSVC (Markus Rickert),
  List headers individually (Markus Rickert),
  Add CMake build files (Markus Rickert),
  Parenthesize Py<type>_Check() in ifs (Miro Hrončok),
  Minor fixes to configure.js (Nick Wellnhofer)
  
   - Bug Fixes:
  Fix null deref in legacy SAX1 parser (Nick Wellnhofer),
  Fix handling of unexpected EOF in xmlParseContent (Nick Wellnhofer),
  Fix line numbers in error messages for mismatched tags (Nick Wellnhofer),
  Fix htmlTagLookup (Nick Wellnhofer),
  Propagate error in xmlParseElementChildrenContentDeclPriv (Nick Wellnhofer),
  Fix user-after-free with `xmllint --xinclude --dropdtd` (Nick Wellnhofer),
  Fix dangling pointer with `xmllint --dropdtd` (Nick Wellnhofer),
  Validate UTF8 in xmlEncodeEntities (Joel Hockey),
  Fix use-after-free with `xmllint --html --push` (Nick Wellnhofer),
  Allow FP division by zero in xmlXPathInit (Nick Wellnhofer),
  Fix xmlGetNodePath with invalid node types (Nick Wellnhofer),
  Fix exponential behavior with recursive entities (Nick Wellnhofer),
  Fix quadratic behavior when looking up xml:* attributes (Nick Wellnhofer),
  Fix slow parsing of HTML with encoding errors (Nick Wellnhofer),
  Fix null deref introduced with previous commit (Nick Wellnhofer),
  Check for invalid redeclarations of predefined entities (Nick Wellnhofer),
  Add the copy of type from original xmlDoc in xmlCopyDoc() (SVGAnimate),
  parser.c: shrink the input buffer when appropriate (Mike Dalessio),
  Fix infinite loop in HTML parser introduced with recent commits (Nick Wellnhofer),
  Fix quadratic runtime when parsing CDATA sections (Nick Wellnhofer),
  Fix timeout when handling recursive entities (Nick Wellnhofer),
  Fix memory leak in xmlParseElementMixedContentDecl (Nick Wellnhofer),
  Fix null deref in xmlStringGetNodeList (Nick Wellnhofer),
  use new htmlParseLookupCommentEnd to find comment ends (Mike Dalessio),
  htmlParseComment: treat `--!>` as if it closed the comment (Mike Dalessio),
  Fix integer overflow in xmlSchemaGetParticleTotalRangeMin (Nick Wellnhofer),
  encoding: fix memleak in xmlRegisterCharEncodingHandler() (Xiaoming Ni),
  xmlschemastypes.c: xmlSchemaGetFacetValueAsULong add, check "facet->val" (Xiaoming Ni),
  Fix null pointer deref in xmlXPtrRangeInsideFunction (Nick Wellnhofer),
  Fix quadratic runtime in HTML push parser with null bytes (Nick Wellnhofer),
  Avoid quadratic checking of identity-constraints (Michael Matz),
  Fix building with ICU 68. (Frederik Seiffert),
  Convert python/libxml.c to PY_SSIZE_T_CLEAN (Victor Stinner),
  Fix xmlURIEscape memory leaks. (Elliott Hughes),
  Avoid call stack overflow with XML reader and recursive XIncludes (Nick Wellnhofer),
  Fix caret in regexp character group (Nick Wellnhofer),
  parser.c: xmlParseCharData peek behavior fixed wrt newlines (Mike Dalessio),
  Fix memory leaks in XPointer string-range function (Nick Wellnhofer),
  Fix use-after-free when XIncluding text from Reader (Nick Wellnhofer),
  Fix SEGV in xmlSAXParseFileWithData (yanjinjq),
  Fix null deref in XPointer expression error path (Nick Wellnhofer),
  Don't call xmlXPathInit directly (Nick Wellnhofer),
  Fix cleanup of attributes in XML reader (Nick Wellnhofer),
  Fix double free in XML reader with XIncludes (Nick Wellnhofer),
  Fix memory leak in xmlXIncludeAddNode error paths (Nick Wellnhofer),
  Revert "Fix quadratic runtime in xi:fallback processing" (Nick Wellnhofer),
  Fix error reporting with xi:fallback (Nick Wellnhofer),
  Fix quadratic runtime in xi:fallback processing (Nick Wellnhofer),
  Fix corner case with empty xi:fallback (Nick Wellnhofer),
  Fix XInclude regression introduced with recent commit (Nick Wellnhofer),
  Fix memory leak in runtest.c (Nick Wellnhofer),
  Make "xmllint --push --recovery" work (Nick Wellnhofer),
  Revert "Do not URI escape in server side includes" (Nick Wellnhofer),
  Fix column number accounting in xmlParse*NameAndCompare (Nick Wellnhofer),
  Stop counting nbChars in parser context (Nick Wellnhofer),
  Fix out-of-bounds read with 'xmllint --htmlout' (Nick Wellnhofer),
  Fix exponential runtime and memory in xi:fallback processing (Nick Wellnhofer),
  Don't process siblings of root in xmlXIncludeProcess (Nick Wellnhofer),
  Don't recurse into xi:include children in xmlXIncludeDoProcess (Nick Wellnhofer),
  Fix memory leak in xmlXIncludeIncludeNode error paths (Nick Wellnhofer),
  Check for custom free function in global destructor (Nick Wellnhofer),
  Fix integer overflow when comparing schema dates (Nick Wellnhofer),
  Fix exponential runtime in xmlFARecurseDeterminism (Nick Wellnhofer),
  Don't try to handle namespaces when building HTML documents (Nick Wellnhofer),
  Fix several quadratic runtime issues in HTML push parser (Nick Wellnhofer),
  Fix quadratic runtime when push parsing HTML start tags (Nick Wellnhofer),
  Reset XML parser input before reporting errors (David Kilzer),
  Fix quadratic runtime when push parsing HTML entity refs (Nick Wellnhofer),
  Fix HTML push parser lookahead (Nick Wellnhofer),
  Make htmlCurrentChar always translate U+0000 (Nick Wellnhofer),
  Fix UTF-8 decoder in HTML parser (Nick Wellnhofer),
  Fix quadratic runtime when parsing HTML script content (Nick Wellnhofer),
  Reset HTML parser input before reporting error (Nick Wellnhofer),
  Fix more quadratic runtime issues in HTML push parser (Nick Wellnhofer),
  Fix regression introduced with 477c7f6a (Nick Wellnhofer),
  Fix quadratic runtime in HTML parser (Nick Wellnhofer),
  Reset HTML parser input before reporting encoding error (Nick Wellnhofer),
  Fix integer overflow in xmlFAParseQuantExact (Nick Wellnhofer),
  Fix return value of xmlC14NDocDumpMemory (Nick Wellnhofer),
  Don't follow next pointer on documents in xmlXPathRunStreamEval (Nick Wellnhofer),
  Fix integer overflow in _xmlSchemaParseGYear (Nick Wellnhofer),
  Fix integer overflow when parsing {min,max}Occurs (Nick Wellnhofer),
  Fix another memory leak in xmlSchemaValAtomicType (Nick Wellnhofer),
  Fix unsigned integer overflow in htmlParseTryOrFinish (Nick Wellnhofer),
  Fix integer overflow in htmlParseCharRef (Nick Wellnhofer),
  Fix undefined behavior in UTF16LEToUTF8 (Nick Wellnhofer),
  Fix return value of xmlCharEncOutput (Nick Wellnhofer),
  Never expand parameter entities in text declaration (Nick Wellnhofer),
  Fix undefined behavior in xmlXPathTryStreamCompile (Nick Wellnhofer),
  Fix use-after-free with validating reader (Nick Wellnhofer),
  xmlParseBalancedChunkMemory must not be called with NULL doc (Nick Wellnhofer),
  Revert "Fix memory leak in xmlParseBalancedChunkMemoryRecover" (Nick Wellnhofer),
  Fix memory leak in xmlXIncludeLoadDoc error path (Nick Wellnhofer),
  Make schema validation fail with multiple top-level elements (Nick Wellnhofer),
  Call xmlCleanupParser on ELF destruction (Samuel Thibault),
  Fix copying of entities in xmlParseReference (Nick Wellnhofer),
  Fix memory leak in xmlSchemaValidateStream (Zhipeng Xie),
  Fix xmlSchemaGetCanonValue formatting for date and dateTime (Kevin Puetz),
  Fix memory leak when shared libxml.dll is unloaded (Kevin Puetz),
  Fix potentially-uninitialized critical section in Win32 DLL builds (Kevin Puetz),
  Fix integer overflow in xmlBufferResize (Nick Wellnhofer),
  Check for overflow when allocating two-dimensional arrays (Nick Wellnhofer),
  Remove useless comparisons (Nick Wellnhofer),
  Fix overflow check in xmlNodeDump (Nick Wellnhofer),
  Fix infinite loop in xmlStringLenDecodeEntities (Zhipeng Xie),
  Fix freeing of nested documents (Nick Wellnhofer),
  Fix more memory leaks in error paths of XPath parser (Nick Wellnhofer),
  Fix memory leaks of encoding handlers in xmlsave.c (Nick Wellnhofer),
  Fix xml2-config error code (Nick Wellnhofer),
  Fix memory leak in error path of XPath expr parser (Nick Wellnhofer),
  Fix overflow handling in xmlBufBackToBuffer (Nick Wellnhofer),
  Null pointer handling in catalog.c (raniervf),
  xml2-config.in: fix regressions introduced by commit 2f2bf4b2c (Dmitry V. Levin)
  
   - Improvements:
  Store per-element parser state in a struct (Nick Wellnhofer),
  update for xsd:language type check (PaulHiggs),
  Update INSTALL.libxml2 (Nick Wellnhofer),
  Fix include order in c14n.h (Nick Wellnhofer),
  Fix duplicate xmlStrEqual calls in htmlParseEndTag (Nick Wellnhofer),
  Speed up htmlCheckAutoClose (Nick Wellnhofer),
  Speed up htmlTagLookup (Nick Wellnhofer),
  Stop checking attributes for UTF-8 validity (Nick Wellnhofer),
  Reduce some fuzzer timeouts (Nick Wellnhofer),
  Only run a few CI tests unless scheduled (Nick Wellnhofer),
  Improve fuzzer stability (Nick Wellnhofer),
  Check for feature flags in fuzzer tests (Nick Wellnhofer),
  Another attempt at improving fuzzer stability (Nick Wellnhofer),
  Revert "Improve HTML fuzzer stability" (Nick Wellnhofer),
  Add charset names to fuzzing dictionaries (Nick Wellnhofer),
  Improve HTML fuzzer stability (Nick Wellnhofer),
  Add CI for MSVC x86 (Markus Rickert),
  Add a flag to not output anything when xmllint succeeded (hhb),
  Speed up HTML fuzzer (Nick Wellnhofer),
  Remove unused encoding parameter of HTML output functions (Nick Wellnhofer),
  Handle malloc failures in fuzzing code (Nick Wellnhofer),
  add test coverage for incorrectly-closed comments (Mike Dalessio),
  Enforce maximum length of fuzz input (Nick Wellnhofer),
  Remove temporary members from struct _xmlXPathContext (Nick Wellnhofer),
  Build the Python extension with PY_SSIZE_T_CLEAN (Victor Stinner),
  Add CI test for Python 3 (Nick Wellnhofer),
