libxml2: Add version 2.13.4, fixes a few CVE issues

[gsantner]

Summary

Changes to recipe: libxml2

Motivation

Stay up to date with somewhat recent releases of upstream, fix CVE issues. Update to latest patch version.

See also: https://gitlab.gnome.org/GNOME/libxml2/-/releases

Details

Version bump

---

• Read the contributing guidelines
• Checked that this PR is not a duplicate: list of PRs by recipe
• Tested locally with at least one configuration using a recent version of Conan

[ErniGH]

Hey @gsantner , thanks a lot for your contribution, but wouldn’t it be better to use the latest version 2.13.4 if the goal is to stay up to date?

[gsantner]

@ErniGH
libxml2 does patch releases for multiple versions, this one is the latest one from the 2.12 series.

My PR initially contained the 2.13 one, but Conan fails to build with that. Having a no-new-features version available is fine too, even with knowing that 2.13 could break some other recipes in turn.

If somebody with more sophisticated Conan recipe knowledge wants to take a look fine too, but I myself suggest only the version bumps when noticing.

[uilianries]

@gsantner Thank you for your PR. Checking the previous build log on Windows:

https://c3i.jfrog.io/c3i/misc-v2/logs/pr/25322/1-windows-msvc/libxml2/2.13.4//6211ea34ed7b04dcc66f5ff3bdfd60394f228be5-build.txt

It failed because mem-debug is no longer available.

Could you please revert your latest commit and getting back 2.13 instead. Then, update the recipe with the follow change:

def config_options(self):
    ...
    if Version(self.version) >= "2.13.0":
        self.options.rm_safe("mem-debug")

Regards!

[gsantner]

@uilianries
Thanks for your reply! I added your suggestion, squashed and force pushed the branch. So only updated 2.13 one is in the commit list now.

Let's see what the CI says 😄

[gsantner]

It failed again. pdb files not created but tried to copy?

[uilianries]

It failed again. pdb files not created but tried to copy?

@gsantner It seems like it's missing some symbols. I'll take a look by Monday. Thank you again!

[gsantner]

Thanks for help!

[AbrilRBS]

@uilianries @gsantner the issue was a missing bcrypt dependency in the new version, see https://gitlab.gnome.org/GNOME/libxml2/-/blob/2.13/win32/Makefile.msvc?ref_type=heads#L84

[AbrilRBS]

Checked https://gitlab.gnome.org/GNOME/libxml2/-/compare/2.12...2.13?from_project_id=1665&page=2&straight=false, seems like we're not missing anything else, thanks!

[uilianries]

@AbrilRBS Thank you so much!!

[uilianries]

LGTM. Nice addition pointing the origin of bcrypt as dependency.

[AbrilRBS]

Update on this: We'll be merging this PR this Wednesday, and run the necessary builds on our end to avoid missing binaries, thanks a lot for taking the time to create the PR, there are no futher actions you need to take, we'll take it from here :)

Just for traceability's shake, the necessary packages we'll rebuild are:

[
    [
        "libva/2.21.0",
        "libva/2.20.0",
        "vulkan-loader/1.2.198.0"
    ],
    [
        "wayland/1.22.0",
        "libxslt/1.1.39",
        "xmlsec/1.3.4",
        "xmlsec/1.3.3",
        "xmlsec/1.3.2",
        "xmlsec/1.2.38",
        "xmlsec/1.2.33",
        "xmlsec/1.2.32",
        "xmlsec/1.2.31",
        "xmlsec/1.2.30",
        "wayland/1.21.0",
        "wayland/1.20.0",
        "wayland/1.19.0",
        "wayland/1.18.0",
        "norm/1.5.9",
        "tmx/1.10.0",
        "tmx/1.4.0"
    ],
    [
        "xkbcommon/1.5.0",
        "xkbcommon/1.6.0",
        "tixi3/3.3.0",
        "azure-sdk-for-cpp/1.11.3",
        "eudev/3.2.14",
        "vulkan-validationlayers/1.3.224.1",
        "xkbcommon/1.4.1",
        "xkbcommon/1.3.1",
        "xkbcommon/1.2.1",
        "xkbcommon/1.1.0",
        "xkbcommon/1.0.3",
        "xkbcommon/0.10.0",
        "vulkan-validationlayers/1.3.216.0",
        "vulkan-validationlayers/1.3.211.0"
    ],
    [
        "wxwidgets/3.2.6",
        "wxwidgets/3.2.5",
        "azure-storage-cpp/7.5.0",
        "freeglut/3.4.0",
        "freeglut/3.2.2",
        "diligent-core/api.252009",
        "diligent-core/api.252005",
        "diligent-core/api.252004",
        "diligent-core/api.252003",
        "diligent-core/2.5.2",
        "diligent-core/2.5.1",
        "diligent-core/api.250014",
        "aravis/0.8.33",
        "aravis/0.8.30",
        "aravis/0.8.29",
        "aravis/0.8.25"
    ],
    [
        "qt/6.7.1",
        "qt/6.6.2",
        "qt/5.15.13",
        "sdl/2.28.3",
        "qt/5.15.7",
        "qt/6.6.3",
        "qt/6.5.3",
        "qt/5.15.14",
        "qt/5.15.9",
        "qt/5.15.11",
        "sdl/2.30.7",
        "sdl/2.30.6",
        "sdl/2.30.5",
        "sdl/2.30.4",
        "sdl/2.30.3",
        "sdl/2.30.2",
        "sdl/2.30.1",
        "sdl/2.28.5",
        "sdl/2.28.2",
        "sdl/2.26.5",
        "sdl/2.26.1",
        "sdl/2.26.0",
        "sdl/2.24.1",
        "sdl/2.24.0",
        "sdl/2.0.20",
        "openslide/4.0.0"
    ],
    [
        "qxmpp/1.4.0",
        "opencv/4.8.1",
        "runtimeqml/cci.20220923",
        "runtimeqml/cci.20211220",
        "qtxlsxwriter/0.3.0",
        "opencv/4.9.0",
        "sdl_image/2.6.3",
        "sdl_image/2.0.5",
        "qcustomplot/1.3.2",
        "quazip/1.4",
        "quazip/1.3",
        "quazip/1.2",
        "quazip/1.1",
        "qwt/6.2.0",
        "mocknetworkaccessmanager/0.12.0",
        "sdl_ttf/2.22.0",
        "sdl_ttf/2.20.2",
        "sdl_ttf/2.20.1",
        "sdl_ttf/2.0.18",
        "sdl_ttf/2.0.15",
        "opencv/4.10.0",
        "qarchive/2.2.8",
        "qarchive/2.2.6",
        "qarchive/2.2.4",
        "qarchive/2.2.3",
        "qarchive/2.1.1",
        "qarchive/2.0.2",
        "qarchive/2.0.1",
        "qxlsx/1.4.5",
        "qxlsx/1.4.4",
        "qxlsx/1.4.3",
        "sdl_net/2.2.0",
        "sdl_net/2.0.1",
        "sdl_mixer/2.8.0",
        "sdl_mixer/2.0.4"
    ],
    [
        "imutils-cpp/1.0.1",
        "stella-cv-fbow/cci.20240508",
        "cctag/1.0.4",
        "cctag/1.0.3",
        "cctag/1.0.1"
    ]
]

/cc @uilianries

[conan-center-bot]

Conan v1 pipeline ✔️

All green in build 8 (4bcce1f47ffad639e60d766b992f12c3c72f4d91):

• libxml2/2.12.4:
  Built 20 packages out of 22 (All logs)

• libxml2/2.11.4:
  Built 20 packages out of 22 (All logs)

• libxml2/2.11.9:
  Built 20 packages out of 22 (All logs)

• libxml2/2.12.9:
  Built 20 packages out of 22 (All logs)

• libxml2/2.12.3:
  Built 20 packages out of 22 (All logs)

• libxml2/2.10.4:
  Built 20 packages out of 22 (All logs)

• libxml2/2.13.4:
  Built 20 packages out of 22 (All logs)

• libxml2/2.11.6:
  Built 20 packages out of 22 (All logs)

• libxml2/2.10.3:
  Built 20 packages out of 22 (All logs)

• libxml2/2.9.14:
  Built 20 packages out of 22 (All logs)

• libxml2/2.9.12:
  Built 20 packages out of 22 (All logs)

• libxml2/2.9.10:
  Built 20 packages out of 22 (All logs)

---

Conan v2 pipeline ✔️

Note: Conan v2 builds are now mandatory. Please read our discussion about it.

All green in build 8 (4bcce1f47ffad639e60d766b992f12c3c72f4d91):

• libxml2/2.12.9:
  All packages built successfully! (All logs)

• libxml2/2.9.12:
  All packages built successfully! (All logs)

• libxml2/2.13.4:
  All packages built successfully! (All logs)

• libxml2/2.11.9:
  All packages built successfully! (All logs)

• libxml2/2.11.6:
  All packages built successfully! (All logs)

• libxml2/2.12.3:
  All packages built successfully! (All logs)

• libxml2/2.12.4:
  All packages built successfully! (All logs)

• libxml2/2.10.4:
  All packages built successfully! (All logs)

• libxml2/2.11.4:
  All packages built successfully! (All logs)

• libxml2/2.9.10:
  All packages built successfully! (All logs)

• libxml2/2.10.3:
  All packages built successfully! (All logs)

• libxml2/2.9.14:
  All packages built successfully! (All logs)

[uilianries]

LGTM

[gsantner]

Hello @AbrilRBS ,
just wanted to make use of the new version. Unfortunately libxslt fails to build now (which depends on libxml2).
When the other new added version libxml2/2.12.9 is specified it works.

Is this reproducable on msvc on CI too?

[AbrilRBS]

@gsantner I'll take a look now, thanks for the ping. What error are you seeing? Is this in linux?

[gsantner]

@AbrilRBS
Windows, MSVC compiler.version=139, x86_64, VS2022.
But may apply to others too

[AbrilRBS]

Thanks @gsantner, I've proposed #25404 to fix the issue. Old versions of libxslt were using deprecated functions that were removed in libxml2 1.13. I've now fixed its version ranges and added a new version of libxslt that supports the newer versions, feel free to use it once it gets merged :)

[gsantner]

Thanks for fixing it! 😄