Release Expat 2.6.2 (ETA 2024-03-13)

[hartwork]

Motivation for cutting a new release:

• OSS-Fuzz/ClusterFuzz finding 66812 #839
  • Reject direct parameter entity recursion (part of #839) #841
  • [CVE-2024-28757] Prevent billion laughs attacks in isolated external parser (part of #839) #842

Regular releases:

• Bump .so version info, document in change log
• Bump release version everywhere (including doc/reference.html)
• Fill release date (both change log and man page date)
• make distcheck source tarballs using ./distribute.sh
• Build Windows installer using AppVeyor CI — https://ci.appveyor.com/project/libexpat/libexpat/builds/49393760/artifacts
• Build Windows binaries zip file from installer
• SourceForge:
  • Upload Windows installer and binaries zip file
  • Upload source tarballs + .asc GPG signature files
  • Make one new source tarball default download for all but Windows
  • Make new binary zip file default download for Windows
• GitHub:
  • Create signed Git tag and push it
  • Create new release — https://github.com/libexpat/libexpat/releases/tag/R_2_6_2
  • Upload source tarballs + .asc GPG signature files
  • Upload Windows installer and binaries zip file
  • Close current milestone and create a follow-up one
• Website
  • Add news item — libexpat/libexpat.github.io@83c0fd4
  • Sync API documentation — libexpat/libexpat.github.io@3820bcb
• Let the community know:
  • Mail Expat distro maintainers directly
  • Write to the xml-dev mailing list — http://lists.xml.org/archives/xml-dev/202403/msg00001.html
  • Blog about it at blog.hartwork.org — https://blog.hartwork.org/posts/expat-2-6-2-released/
  • Submit to Hacker News — https://news.ycombinator.com/item?id=39696657
  • Submit to Lobsters — https://lobste.rs/s/u8tjze/expat_2_6_2_released_includes_security
  • Blog about it at xml.com — https://www.xml.com/news/2024-03-expat-262/
• Bump ebuild in Gentoo — gentoo/gentoo@b5ae6bf

Specific to 2.6.2:

• security aspects

Related downstream issues and pull requests:

• CPython — Please upgrade bundled Expat to 2.6.2 (e.g. for the fix to CVE-2024-28757) python/cpython#116741
• Gentoo
  • https://bugs.gentoo.org/926786
  • gentoo/gentoo@b5ae6bf
• NixOS — expat: 2.6.0 -> 2.6.2 NixOS/nixpkgs#292430
• Spack — expat: Add latest release 2.6.2 with security fixes spack/spack#43171