vendor/expat/2.8.0vendor/expat

46 files changed, 1129 insertions, 734 deletions

diff --git a/Changes b/Changes
index 2b3704a69b77..87611eea5c01 100644
--- a/Changes
+++ b/Changes
@@ -29,6 +29,72 @@
 !! THANK YOU!                        Sebastian Pipping -- Berlin, 2026-03-17 !!
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
+Release 2.8.0 Fri April 24 2026
+        Security fixes:
+       #47 #1183  CVE-2026-41080 -- The existing hash flooding protection
+                    (based on SipHash) only used 4 to 8 bytes of entropy for
+                    a salt, when 16 bytes of salt are supported by the
+                    implementation of SipHash used by Expat. Now full 16 bytes
+                    of entropy are used to improve protection against hash
+                    flooding attacks.
+                      Existing API function XML_SetHashSalt is now deprecated
+                    because of its limitations, and its use should be
+                    considered a vulnerability. Please either use the new API
+                    function XML_SetHashSalt16Bytes (with known-high-quality
+                    entropy input only!) instead, or leave the derivation of
+                    a 16-bytes hash salt from high quality entropy to Expat's
+                    internal machinery (by *not* calling either of the two
+                    XML_SetHashSalt* functions).
+
+        Bug fixes:
+           #1188  Avoid propagating /dev/urandom file descriptor to child
+                    processes
+           #1193  Fix interpretation of `errno` after randomization calls
+           #1195  Avoid assuming uint8_t is a character type
+
+        Other changes:
+     #1180 #1199  Add support for `getentropy(3)` as a source of entropy;
+                    this helps with protecting against hash flooding attacks,
+                    in particular with WASI SDK (where none of the other
+                    entropy sources supported by libexpat are available).
+           #1200  Autotools: Add `--without-arc4random` and
+                    `--without-arc4random-buf`
+           #1200  Autotools: Make `./configure` output report on available
+                    high quality entropy sources
+           #1173  Autotools|macOS: Sync CMake templates with CMake 4.3.0
+           #1201  Autotools|CMake: Improve checks for `arc4random` and
+                    `arc4random_buf` e.g. with modern glibc
+           #1201  CMake: Report on availability of functions `arc4random` and
+                    `arc4random_buf`
+           #1201  CMake: Mark entropy related build switches as advanced
+        #1189 ..
+     #1203 #1204  Extract new files from entropy extraction code
+           #1194  Stop duplicating C tests 1:1 as C++ ("runtests_cxx")
+           #1202  Fix a comment typo in expat_external.h
+           #1187  Fix grammar in compile error message
+           #1192  examples: Build warning-free with -Wwrite-strings
+           #1171  tests: Address harmless warning from Coverity
+     #1170 #1176  Sync file headers
+     #1190 #1206  Version info bumped from 12:3:11 (libexpat*.so.1.11.3)
+                    to 13:0:12 (libexpat*.so.1.12.0); see https://verbump.de/
+                    for what these numbers do
+
+        Infrastructure:
+  #1166 #1167 ..
+  #1172 #1175 ..
+  #1178 #1179 ..
+     #1185 #1205  CI: Make Perl XML::Parser integration tests run against
+                    both version 2.47 and the latest release 2.58
+           #1169  CI: Adapt to breaking changes regarding Inno Setup
+           #1173  CI: Adapt to breaking changes regarding CMake
+           #1174  CI: Include public corpus of fuzzer `xml_lpm_fuzzer` with
+                    regression testing
+     #1181 #1182  CI: Bump WASI SDK from 30 to 32
+
+        Special thanks to:
+            Jérôme Duval
+            Matthew Fernandez
+
 Release 2.7.5 Tue March 17 2026
         Security fixes:
            #1158  CVE-2026-32776 -- Fix NULL function pointer dereference for
diff --git a/README.md b/README.md
index a67548be7fc9..619e60b2d16b 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 > at the top of the `Changes` file.
 
 
-# Expat, Release 2.7.5
+# Expat, Release 2.8.0
 
 This is Expat, a C99 library for parsing
 [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by
@@ -297,10 +297,4 @@ EXPAT_SYMBOL_VERSIONING:BOOL=OFF
 
 // Treat all compiler warnings as errors
 EXPAT_WARNINGS_AS_ERRORS:BOOL=OFF
-
-// Make use of getrandom function (ON|OFF|AUTO) [default=AUTO]
-EXPAT_WITH_GETRANDOM:STRING=AUTO
-
-// Make use of syscall SYS_getrandom (ON|OFF|AUTO) [default=AUTO]
-EXPAT_WITH_SYS_GETRANDOM:STRING=AUTO
 ```
diff --git a/configure.ac b/configure.ac
index 6d028b5f6658..87633650f321 100644
--- a/configure.ac
+++ b/configure.ac
@@ -89,9 +89,9 @@ dnl
 dnl If the API changes incompatibly set LIBAGE back to 0
 dnl
 
-LIBCURRENT=12  # sync
-LIBREVISION=3  # with
-LIBAGE=11      # CMakeLists.txt!
+LIBCURRENT=13  # sync
+LIBREVISION=0  # with
+LIBAGE=12      # CMakeLists.txt!
 
 AC_CONFIG_HEADERS([expat_config.h])
 AH_TOP([#ifndef EXPAT_CONFIG_H
@@ -217,21 +217,51 @@ AM_CONDITIONAL([_INTERNAL_LARGE_SIZE], [echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP
 
 LT_LIB_M
 
-AC_MSG_CHECKING([for arc4random_buf (BSD or glibc 2.36+)])
-AC_LINK_IFELSE([AC_LANG_SOURCE([
-    #include <stdlib.h>
-    int main(void) {
-      char dummy[[123]];  // double brackets for m4
-      arc4random_buf(dummy, 0U);
-      return 0;
-    }
-  ])],
-  [AC_DEFINE([HAVE_ARC4RANDOM_BUF], [1], [Define to 1 if you have the `arc4random_buf' function.])
-   AC_MSG_RESULT([yes])],
-  [AC_MSG_RESULT([no])
+AC_ARG_WITH([arc4random],
+  [AS_HELP_STRING([--with-arc4random],
+                  [enforce the use of arc4random function in the system @<:@default=check@:>@])
+AS_HELP_STRING([--without-arc4random],
+               [skip auto detect of arc4random @<:@default=check@:>@])],
+  [],
+  [with_arc4random=check])
+
+AC_ARG_WITH([arc4random-buf],
+  [AS_HELP_STRING([--with-arc4random-buf],
+                  [enforce the use of arc4random_buf function in the system @<:@default=check@:>@])
+AS_HELP_STRING([--without-arc4random-buf],
+               [skip auto detect of arc4random_buf @<:@default=check@:>@])],
+  [],
+  [with_arc4random_buf=check])
+
+have_arc4random=false
+have_arc4random_buf=false
+
+AS_IF([test "x${with_arc4random_buf}" != xno],
+  [AC_MSG_CHECKING([for arc4random_buf (BSD or glibc 2.36+)])
+   AC_LINK_IFELSE([AC_LANG_SOURCE([
+       #if ! defined(_DEFAULT_SOURCE)
+       # define _DEFAULT_SOURCE 1 /* for glibc */
+       #endif
+       #include <stdlib.h>
+       int main(void) {
+         char dummy[[123]];  // double brackets for m4
+         arc4random_buf(dummy, 0U);
+         return 0;
+       }
+     ])],
+     [AC_DEFINE([HAVE_ARC4RANDOM_BUF], [1], [Define to 1 if you have the `arc4random_buf' function.])
+      have_arc4random_buf=true
+      AC_MSG_RESULT([yes])],
+     [AC_MSG_RESULT([no])
+      AS_IF([test "x${with_arc4random_buf}" = xyes],
+        [AC_MSG_ERROR([enforced the use of arc4random_buf --with-arc4random-buf, but not detected])])])])
 
-   AC_MSG_CHECKING([for arc4random (BSD, macOS, or glibc 2.36+)])
+AS_IF([test "x${with_arc4random}" != xno],
+  [AC_MSG_CHECKING([for arc4random (BSD, macOS, or glibc 2.36+)])
    AC_LINK_IFELSE([AC_LANG_SOURCE([
+       #if ! defined(_DEFAULT_SOURCE)
+       # define _DEFAULT_SOURCE 1 /* for glibc */
+       #endif
        #include <stdlib.h>
        int main(void) {
           arc4random();
@@ -239,8 +269,58 @@ AC_LINK_IFELSE([AC_LANG_SOURCE([
        }
      ])],
      [AC_DEFINE([HAVE_ARC4RANDOM], [1], [Define to 1 if you have the `arc4random' function.])
+      have_arc4random=true
       AC_MSG_RESULT([yes])],
-     [AC_MSG_RESULT([no])])])
+     [AC_MSG_RESULT([no])
+      AS_IF([test "x${with_arc4random}" = xyes],
+        [AC_MSG_ERROR([enforced the use of arc4random --with-arc4random, but not detected])])])])
+
+AM_CONDITIONAL([WITH_ARC4RANDOM], [test x${have_arc4random} = xtrue])
+AM_CONDITIONAL([WITH_ARC4RANDOM_BUF], [test x${have_arc4random_buf} = xtrue])
+
+have_getentropy=false
+
+AC_ARG_WITH([getentropy],
+  [AS_HELP_STRING([--with-getentropy],
+                  [enforce the use of getentropy function in the system @<:@default=check@:>@])
+AS_HELP_STRING([--without-getentropy],
+               [skip auto detect of getentropy @<:@default=check@:>@])],
+  [],
+  [with_getentropy=check])
+
+AS_IF([test "x$with_getentropy" != xno],
+  [AC_MSG_CHECKING([for getentropy (BSD, macOS 10.12+, glibc 2.25+)])
+   AC_LINK_IFELSE([AC_LANG_SOURCE([
+       // NOTE: Please keep this block in sync with its two siblings in files
+       //       'ConfigureChecks.cmake' and 'lib/random_getentropy.c'!
+       #if defined(__APPLE__)
+       #  include <sys/random.h>
+       #else
+       #  if defined(__GLIBC__) && ! defined(_DEFAULT_SOURCE)
+       #    define _DEFAULT_SOURCE 1
+       #  endif
+       #  if ! defined(_GNU_SOURCE)
+       #    define _GNU_SOURCE 1 /* for musl */
+       #  endif
+       #  include <unistd.h>
+       #endif // ! defined(__APPLE__)
+
+       int main(void) {
+         return getentropy(NULL, 0U);
+       }
+     ])],
+     [AC_DEFINE([HAVE_GETENTROPY], [1], [Define to 1 if you have the `getentropy' function.])
+      have_getentropy=true
+      AC_MSG_RESULT([yes])],
+     [AC_MSG_RESULT([no])
+      AS_IF([test "x$with_getentropy" = xyes],
+        [AC_MSG_ERROR([enforced the use of getentropy --with-getentropy, but not detected])])])])
+
+AM_CONDITIONAL([WITH_GETENTROPY], [test x${have_getentropy} = xtrue])
+
+have_either_getrandom=false
+have_getrandom_function=false
+have_getrandom_syscall=false
 
 AC_ARG_WITH([getrandom],
   [AS_HELP_STRING([--with-getrandom],
@@ -260,6 +340,8 @@ AS_IF([test "x$with_getrandom" != xno],
        }
      ])],
      [AC_DEFINE([HAVE_GETRANDOM], [1], [Define to 1 if you have the `getrandom' function.])
+      have_either_getrandom=true
+      have_getrandom_function=true
       AC_MSG_RESULT([yes])],
      [AC_MSG_RESULT([no])
       AS_IF([test "x$with_getrandom" = xyes],
@@ -286,11 +368,15 @@ AS_IF([test "x$with_sys_getrandom" != xno],
      }
    ])],
      [AC_DEFINE([HAVE_SYSCALL_GETRANDOM], [1], [Define to 1 if you have `syscall' and `SYS_getrandom'.])
+      have_either_getrandom=true
+      have_getrandom_syscall=true
       AC_MSG_RESULT([yes])],
      [AC_MSG_RESULT([no])
       AS_IF([test "x$with_sys_getrandom" = xyes],
         [AC_MSG_ERROR([enforced the use of syscall SYS_getrandom --with-sys-getrandom, but not detected])])])])
 
+AM_CONDITIONAL([WITH_EITHER_GETRANDOM], [test x${have_either_getrandom} = xtrue])
+
 dnl Only needed for xmlwf:
 AC_CHECK_HEADERS(fcntl.h unistd.h)
 AC_TYPE_OFF_T
@@ -486,4 +572,17 @@ User flags (override Automake flags on conflict):
      CPPFLAGS: ${CPPFLAGS}
        CFLAGS: ${CFLAGS}
      CXXFLAGS: ${CXXFLAGS}
-      LDFLAGS: ${LDFLAGS}])
+      LDFLAGS: ${LDFLAGS}
+
+Entropy sources:
+             arc4random: ${have_arc4random}
+         arc4random_buf: ${have_arc4random_buf}
+             getentropy: ${have_getentropy}
+              getrandom: ${have_getrandom_function}
+  syscall SYS_getrandom: ${have_getrandom_syscall}
+           /dev/urandom: true
+
+Continue with e.g.:
+  make -j2
+  make check
+  sudo make install])
diff --git a/doc/reference.html b/doc/reference.html
index 5faa8d6515af..195bd183fd82 100644
--- a/doc/reference.html
+++ b/doc/reference.html
@@ -53,7 +53,7 @@
   <body>
     <div>
       <h1>
-        The Expat XML Parser <small>Release 2.7.5</small>
+        The Expat XML Parser <small>Release 2.8.0</small>
       </h1>
     </div>
 
@@ -404,7 +404,11 @@
                 </li>
 
                 <li>
-                  <a href="#XML_SetHashSalt">XML_SetHashSalt</a>
+                  <a href="#XML_SetHashSalt">XML_SetHashSalt</a> (deprecated)
+                </li>
+
+                <li>
+                  <a href="#XML_SetHashSalt16Bytes">XML_SetHashSalt16Bytes</a>
                 </li>
 
                 <li>
@@ -3449,22 +3453,35 @@ XML_SetParamEntityParsing(XML_Parser p,
       </div>
 
       <h4 id="XML_SetHashSalt">
-        XML_SetHashSalt
+        XML_SetHashSalt (deprecated)
       </h4>
 
       <pre class="fcndec">
 int XMLCALL
-XML_SetHashSalt(XML_Parser p,
+XML_SetHashSalt(XML_Parser parser,
                 unsigned long hash_salt);
 </pre>
       <div class="fcndef">
         Sets the hash salt to use for internal hash calculations. Helps in preventing DoS
         attacks based on predicting hash function behavior. In order to have an effect
         this must be called before parsing has started. Returns 1 if successful, 0 when
-        called after <code>XML_Parse</code> or <code>XML_ParseBuffer</code>.
+        called after <code>XML_Parse</code> or <code>XML_ParseBuffer</code> or when
+        <code>parser</code> is <code>NULL</code>.
+        <p>
+          <b>Note:</b> Function <code>XML_SetHashSalt</code> is
+          <strong>deprecated</strong>. Please use function <code><a href=
+          "#XML_SetHashSalt16Bytes">XML_SetHashSalt16Bytes</a></code> instead for better
+          security. <code>XML_SetHashSalt</code> only provides 4 to 8 bytes of entropy
+          (depending on the size of type <code>unsigned long</code>) while the SipHash
+          implementation used by Expat can leverage up to 16 bytes of entropy — at least
+          twice as much. Function <code><a href=
+          "#XML_SetHashSalt16Bytes">XML_SetHashSalt16Bytes</a></code> of Expat &gt;=2.8.0
+          (and where backported) matches the amount of entropy supported by SipHash.
+        </p>
+
         <p>
           <b>Note:</b> This call is optional, as the parser will auto-generate a new
-          random salt value if no value has been set at the start of parsing.
+          random salt value internally if no value has been set by the start of parsing.
         </p>
 
         <p>
@@ -3475,6 +3492,34 @@ XML_SetHashSalt(XML_Parser p,
         </p>
       </div>
 
+      <h4 id="XML_SetHashSalt16Bytes">
+        XML_SetHashSalt16Bytes
+      </h4>
+
+      <pre class="fcndec">
+/* Added in Expat 2.8.0. */
+XML_Bool XMLCALL
+XML_SetHashSalt16Bytes(XML_Parser parser,
+                       const uint8_t entropy[16]);
+</pre>
+      <div class="fcndef">
+        Sets the hash salt to use for internal hash calculations. Helps in preventing DoS
+        attacks based on predicting hash function behavior. In order to have an effect
+        this must be called before parsing has started. Returns <code>XML_TRUE</code> if
+        successful, <code>XML_FALSE</code> when called after <code>XML_Parse</code> or
+        <code>XML_ParseBuffer</code> or when <code>parser</code> is <code>NULL</code>.
+        <p>
+          <b>Note:</b> Setting a salt that is <em>not</em> from a source of high quality
+          entropy (like <code>getentropy(3)</code>) will make the parser vulnerable to
+          hash flooding attacks.
+        </p>
+
+        <p>
+          <b>Note:</b> This call is optional, as the parser will auto-generate a new
+          random salt value internally if no value has been set by the start of parsing.
+        </p>
+      </div>
+
       <h4 id="XML_UseForeignDTD">
         XML_UseForeignDTD
       </h4>
diff --git a/doc/xmlwf.1 b/doc/xmlwf.1
index 75318fccc856..0736f110e3c1 100644
--- a/doc/xmlwf.1
+++ b/doc/xmlwf.1
@@ -5,7 +5,7 @@
 \\$2 \(la\\$1\(ra\\$3
 ..
 .if \n(.g .mso www.tmac
-.TH XMLWF 1 "March 17, 2026" "" ""
+.TH XMLWF 1 "April 24, 2026" "" ""
 .SH NAME
 xmlwf \- Determines if an XML document is well-formed
 .SH SYNOPSIS
diff --git a/doc/xmlwf.xml b/doc/xmlwf.xml
index c4fe92d44fb4..3a3897750cb1 100644
--- a/doc/xmlwf.xml
+++ b/doc/xmlwf.xml
@@ -21,7 +21,7 @@
           "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   <!ENTITY dhfirstname "<firstname>Scott</firstname>">
   <!ENTITY dhsurname   "<surname>Bronson</surname>">
-  <!ENTITY dhdate      "<date>March 17, 2026</date>">
+  <!ENTITY dhdate      "<date>April 24, 2026</date>">
   <!-- Please adjust this^^ date whenever cutting a new release. -->
   <!ENTITY dhsection   "<manvolnum>1</manvolnum>">
   <!ENTITY dhemail     "<email>bronson@rinspin.com</email>">
diff --git a/examples/element_declarations.c b/examples/element_declarations.c
index d644b2ffa5ea..d864cf70a2f7 100644
--- a/examples/element_declarations.c
+++ b/examples/element_declarations.c
@@ -16,6 +16,7 @@
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2019      Zhongyuan Zhou <zhouzhongyuan@huawei.com>
    Copyright (c) 2024      Hanno Böck <hanno@gentoo.org>
+   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -82,7 +83,7 @@ stackPopFree(Stack *stackTop) {
   return newStackTop;
 }
 
-static char *
+static const char *
 contentTypeName(enum XML_Content_Type contentType) {
   switch (contentType) {
   case XML_CTYPE_EMPTY:
@@ -102,7 +103,7 @@ contentTypeName(enum XML_Content_Type contentType) {
   }
 }
 
-static char *
+static const char *
 contentQuantName(enum XML_Content_Quant contentQuant) {
   switch (contentQuant) {
   case XML_CQUANT_NONE:
diff --git a/expat_config.h.in b/expat_config.h.in
index 7541bf6005e6..4d7d732e8052 100644
--- a/expat_config.h.in
+++ b/expat_config.h.in
@@ -24,6 +24,9 @@
 /* Define to 1 if you have the <fcntl.h> header file. */
 #undef HAVE_FCNTL_H
 
+/* Define to 1 if you have the `getentropy' function. */
+#undef HAVE_GETENTROPY
+
 /* Define to 1 if you have the 'getpagesize' function. */
 #undef HAVE_GETPAGESIZE
 
diff --git a/lib/Makefile.am b/lib/Makefile.am
index 493077231c57..27bf2ab64769 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -55,6 +55,42 @@ libexpat_la_SOURCES = \
     xmltok.c \
     xmlrole.c
 
+if WITH_ARC4RANDOM
+    libexpat_la_SOURCES += \
+        random_arc4random.c \
+        random_arc4random.h
+endif
+
+if WITH_ARC4RANDOM_BUF
+    libexpat_la_SOURCES += \
+        random_arc4random_buf.c \
+        random_arc4random_buf.h
+endif
+
+if ! MINGW
+    libexpat_la_SOURCES += \
+        random_dev_urandom.c \
+        random_dev_urandom.h
+endif
+
+if WITH_GETENTROPY
+    libexpat_la_SOURCES += \
+        random_getentropy.c \
+        random_getentropy.h
+endif
+
+if WITH_EITHER_GETRANDOM
+    libexpat_la_SOURCES += \
+        random_getrandom.c \
+        random_getrandom.h
+endif
+
+if MINGW
+    libexpat_la_SOURCES += \
+        random_rand_s.c \
+        random_rand_s.h
+endif
+
 if WITH_TESTS
 libtestpat_la_CPPFLAGS = -DXML_TESTING
 
diff --git a/lib/Makefile.in b/lib/Makefile.in
index d8e4fd59e117..4cd6fcfc6088 100644
--- a/lib/Makefile.in
+++ b/lib/Makefile.in
@@ -126,6 +126,30 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 @HAVE_VSCRIPT_TRUE@am__append_1 = $(VSCRIPT_LDFLAGS),@builddir@/libexpat.map
+@WITH_ARC4RANDOM_TRUE@am__append_2 = \
+@WITH_ARC4RANDOM_TRUE@        random_arc4random.c \
+@WITH_ARC4RANDOM_TRUE@        random_arc4random.h
+
+@WITH_ARC4RANDOM_BUF_TRUE@am__append_3 = \
+@WITH_ARC4RANDOM_BUF_TRUE@        random_arc4random_buf.c \
+@WITH_ARC4RANDOM_BUF_TRUE@        random_arc4random_buf.h
+
+@MINGW_FALSE@am__append_4 = \
+@MINGW_FALSE@        random_dev_urandom.c \
+@MINGW_FALSE@        random_dev_urandom.h
+
+@WITH_GETENTROPY_TRUE@am__append_5 = \
+@WITH_GETENTROPY_TRUE@        random_getentropy.c \
+@WITH_GETENTROPY_TRUE@        random_getentropy.h
+
+@WITH_EITHER_GETRANDOM_TRUE@am__append_6 = \
+@WITH_EITHER_GETRANDOM_TRUE@        random_getrandom.c \
+@WITH_EITHER_GETRANDOM_TRUE@        random_getrandom.h
+
+@MINGW_TRUE@am__append_7 = \
+@MINGW_TRUE@        random_rand_s.c \
+@MINGW_TRUE@        random_rand_s.h
+
 subdir = lib
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
@@ -180,7 +204,21 @@ am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(docdir)" \
 	"$(DESTDIR)$(includedir)"
 LTLIBRARIES = $(lib_LTLIBRARIES) $(noinst_LTLIBRARIES)
 libexpat_la_LIBADD =
-am_libexpat_la_OBJECTS = xmlparse.lo xmltok.lo xmlrole.lo
+am__libexpat_la_SOURCES_DIST = xmlparse.c xmltok.c xmlrole.c \
+	random_arc4random.c random_arc4random.h \
+	random_arc4random_buf.c random_arc4random_buf.h \
+	random_dev_urandom.c random_dev_urandom.h random_getentropy.c \
+	random_getentropy.h random_getrandom.c random_getrandom.h \
+	random_rand_s.c random_rand_s.h
+@WITH_ARC4RANDOM_TRUE@am__objects_1 = random_arc4random.lo
+@WITH_ARC4RANDOM_BUF_TRUE@am__objects_2 = random_arc4random_buf.lo
+@MINGW_FALSE@am__objects_3 = random_dev_urandom.lo
+@WITH_GETENTROPY_TRUE@am__objects_4 = random_getentropy.lo
+@WITH_EITHER_GETRANDOM_TRUE@am__objects_5 = random_getrandom.lo
+@MINGW_TRUE@am__objects_6 = random_rand_s.lo
+am_libexpat_la_OBJECTS = xmlparse.lo xmltok.lo xmlrole.lo \
+	$(am__objects_1) $(am__objects_2) $(am__objects_3) \
+	$(am__objects_4) $(am__objects_5) $(am__objects_6)
 libexpat_la_OBJECTS = $(am_libexpat_la_OBJECTS)
 AM_V_lt = $(am__v_lt_@AM_V@)
 am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
@@ -190,10 +228,26 @@ libexpat_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
 	$(libexpat_la_LDFLAGS) $(LDFLAGS) -o $@
 libtestpat_la_LIBADD =
-am__libtestpat_la_SOURCES_DIST = xmlparse.c xmltok.c xmlrole.c
-am__objects_1 = libtestpat_la-xmlparse.lo libtestpat_la-xmltok.lo \
-	libtestpat_la-xmlrole.lo
-@WITH_TESTS_TRUE@am_libtestpat_la_OBJECTS = $(am__objects_1)
+am__libtestpat_la_SOURCES_DIST = xmlparse.c xmltok.c xmlrole.c \
+	random_arc4random.c random_arc4random.h \
+	random_arc4random_buf.c random_arc4random_buf.h \
+	random_dev_urandom.c random_dev_urandom.h random_getentropy.c \
+	random_getentropy.h random_getrandom.c random_getrandom.h \
+	random_rand_s.c random_rand_s.h
+@WITH_ARC4RANDOM_TRUE@am__objects_7 =  \
+@WITH_ARC4RANDOM_TRUE@	libtestpat_la-random_arc4random.lo
+@WITH_ARC4RANDOM_BUF_TRUE@am__objects_8 = libtestpat_la-random_arc4random_buf.lo
+@MINGW_FALSE@am__objects_9 = libtestpat_la-random_dev_urandom.lo
+@WITH_GETENTROPY_TRUE@am__objects_10 =  \
+@WITH_GETENTROPY_TRUE@	libtestpat_la-random_getentropy.lo
+@WITH_EITHER_GETRANDOM_TRUE@am__objects_11 =  \
+@WITH_EITHER_GETRANDOM_TRUE@	libtestpat_la-random_getrandom.lo
+@MINGW_TRUE@am__objects_12 = libtestpat_la-random_rand_s.lo
+am__objects_13 = libtestpat_la-xmlparse.lo libtestpat_la-xmltok.lo \
+	libtestpat_la-xmlrole.lo $(am__objects_7) $(am__objects_8) \
+	$(am__objects_9) $(am__objects_10) $(am__objects_11) \
+	$(am__objects_12)
+@WITH_TESTS_TRUE@am_libtestpat_la_OBJECTS = $(am__objects_13)
 libtestpat_la_OBJECTS = $(am_libtestpat_la_OBJECTS)
 @WITH_TESTS_TRUE@am_libtestpat_la_rpath =
 AM_V_P = $(am__v_P_@AM_V@)
@@ -211,10 +265,22 @@ am__v_at_1 =
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/conftools/depcomp
 am__maybe_remake_depfiles = depfiles
-am__depfiles_remade = ./$(DEPDIR)/libtestpat_la-xmlparse.Plo \
+am__depfiles_remade = ./$(DEPDIR)/libtestpat_la-random_arc4random.Plo \
+	./$(DEPDIR)/libtestpat_la-random_arc4random_buf.Plo \
+	./$(DEPDIR)/libtestpat_la-random_dev_urandom.Plo \
+	./$(DEPDIR)/libtestpat_la-random_getentropy.Plo \
+	./$(DEPDIR)/libtestpat_la-random_getrandom.Plo \
+	./$(DEPDIR)/libtestpat_la-random_rand_s.Plo \
+	./$(DEPDIR)/libtestpat_la-xmlparse.Plo \
 	./$(DEPDIR)/libtestpat_la-xmlrole.Plo \
-	./$(DEPDIR)/libtestpat_la-xmltok.Plo ./$(DEPDIR)/xmlparse.Plo \
-	./$(DEPDIR)/xmlrole.Plo ./$(DEPDIR)/xmltok.Plo
+	./$(DEPDIR)/libtestpat_la-xmltok.Plo \
+	./$(DEPDIR)/random_arc4random.Plo \
+	./$(DEPDIR)/random_arc4random_buf.Plo \
+	./$(DEPDIR)/random_dev_urandom.Plo \
+	./$(DEPDIR)/random_getentropy.Plo \
+	./$(DEPDIR)/random_getrandom.Plo ./$(DEPDIR)/random_rand_s.Plo \
+	./$(DEPDIR)/xmlparse.Plo ./$(DEPDIR)/xmlrole.Plo \
+	./$(DEPDIR)/xmltok.Plo
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -235,7 +301,7 @@ am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
 am__v_CCLD_0 = @echo "  CCLD    " $@;
 am__v_CCLD_1 = 
 SOURCES = $(libexpat_la_SOURCES) $(libtestpat_la_SOURCES)
-DIST_SOURCES = $(libexpat_la_SOURCES) \
+DIST_SOURCES = $(am__libexpat_la_SOURCES_DIST) \
 	$(am__libtestpat_la_SOURCES_DIST)
 am__can_run_installinfo = \
   case $$AM_UPDATE_INFO_DIR in \
@@ -428,11 +494,9 @@ lib_LTLIBRARIES = libexpat.la
 @WITH_TESTS_TRUE@noinst_LTLIBRARIES = libtestpat.la
 libexpat_la_LDFLAGS = @AM_LDFLAGS@ @LIBM@ -no-undefined -version-info \
 	@LIBCURRENT@:@LIBREVISION@:@LIBAGE@ $(am__append_1)
-libexpat_la_SOURCES = \
-    xmlparse.c \
-    xmltok.c \
-    xmlrole.c
-
+libexpat_la_SOURCES = xmlparse.c xmltok.c xmlrole.c $(am__append_2) \
+	$(am__append_3) $(am__append_4) $(am__append_5) \
+	$(am__append_6) $(am__append_7)
 @WITH_TESTS_TRUE@libtestpat_la_CPPFLAGS = -DXML_TESTING
 @WITH_TESTS_TRUE@libtestpat_la_SOURCES = $(libexpat_la_SOURCES)
 doc_DATA = \
@@ -548,9 +612,21 @@ mostlyclean-compile:
 distclean-compile:
 	-rm -f *.tab.c
 
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-random_arc4random.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-random_arc4random_buf.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-random_dev_urandom.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-random_getentropy.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-random_getrandom.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-random_rand_s.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-xmlparse.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-xmlrole.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libtestpat_la-xmltok.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random_arc4random.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random_arc4random_buf.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random_dev_urandom.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random_getentropy.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random_getrandom.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random_rand_s.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xmlparse.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xmlrole.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xmltok.Plo@am__quote@ # am--include-marker
@@ -603,6 +679,48 @@ libtestpat_la-xmlrole.lo: xmlrole.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-xmlrole.lo `test -f 'xmlrole.c' || echo '$(srcdir)/'`xmlrole.c
 
+libtestpat_la-random_arc4random.lo: random_arc4random.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libtestpat_la-random_arc4random.lo -MD -MP -MF $(DEPDIR)/libtestpat_la-random_arc4random.Tpo -c -o libtestpat_la-random_arc4random.lo `test -f 'random_arc4random.c' || echo '$(srcdir)/'`random_arc4random.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libtestpat_la-random_arc4random.Tpo $(DEPDIR)/libtestpat_la-random_arc4random.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='random_arc4random.c' object='libtestpat_la-random_arc4random.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-random_arc4random.lo `test -f 'random_arc4random.c' || echo '$(srcdir)/'`random_arc4random.c
+
+libtestpat_la-random_arc4random_buf.lo: random_arc4random_buf.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libtestpat_la-random_arc4random_buf.lo -MD -MP -MF $(DEPDIR)/libtestpat_la-random_arc4random_buf.Tpo -c -o libtestpat_la-random_arc4random_buf.lo `test -f 'random_arc4random_buf.c' || echo '$(srcdir)/'`random_arc4random_buf.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libtestpat_la-random_arc4random_buf.Tpo $(DEPDIR)/libtestpat_la-random_arc4random_buf.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='random_arc4random_buf.c' object='libtestpat_la-random_arc4random_buf.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-random_arc4random_buf.lo `test -f 'random_arc4random_buf.c' || echo '$(srcdir)/'`random_arc4random_buf.c
+
+libtestpat_la-random_dev_urandom.lo: random_dev_urandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libtestpat_la-random_dev_urandom.lo -MD -MP -MF $(DEPDIR)/libtestpat_la-random_dev_urandom.Tpo -c -o libtestpat_la-random_dev_urandom.lo `test -f 'random_dev_urandom.c' || echo '$(srcdir)/'`random_dev_urandom.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libtestpat_la-random_dev_urandom.Tpo $(DEPDIR)/libtestpat_la-random_dev_urandom.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='random_dev_urandom.c' object='libtestpat_la-random_dev_urandom.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-random_dev_urandom.lo `test -f 'random_dev_urandom.c' || echo '$(srcdir)/'`random_dev_urandom.c
+
+libtestpat_la-random_getentropy.lo: random_getentropy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libtestpat_la-random_getentropy.lo -MD -MP -MF $(DEPDIR)/libtestpat_la-random_getentropy.Tpo -c -o libtestpat_la-random_getentropy.lo `test -f 'random_getentropy.c' || echo '$(srcdir)/'`random_getentropy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libtestpat_la-random_getentropy.Tpo $(DEPDIR)/libtestpat_la-random_getentropy.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='random_getentropy.c' object='libtestpat_la-random_getentropy.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-random_getentropy.lo `test -f 'random_getentropy.c' || echo '$(srcdir)/'`random_getentropy.c
+
+libtestpat_la-random_getrandom.lo: random_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libtestpat_la-random_getrandom.lo -MD -MP -MF $(DEPDIR)/libtestpat_la-random_getrandom.Tpo -c -o libtestpat_la-random_getrandom.lo `test -f 'random_getrandom.c' || echo '$(srcdir)/'`random_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libtestpat_la-random_getrandom.Tpo $(DEPDIR)/libtestpat_la-random_getrandom.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='random_getrandom.c' object='libtestpat_la-random_getrandom.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-random_getrandom.lo `test -f 'random_getrandom.c' || echo '$(srcdir)/'`random_getrandom.c
+
+libtestpat_la-random_rand_s.lo: random_rand_s.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libtestpat_la-random_rand_s.lo -MD -MP -MF $(DEPDIR)/libtestpat_la-random_rand_s.Tpo -c -o libtestpat_la-random_rand_s.lo `test -f 'random_rand_s.c' || echo '$(srcdir)/'`random_rand_s.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libtestpat_la-random_rand_s.Tpo $(DEPDIR)/libtestpat_la-random_rand_s.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='random_rand_s.c' object='libtestpat_la-random_rand_s.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libtestpat_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libtestpat_la-random_rand_s.lo `test -f 'random_rand_s.c' || echo '$(srcdir)/'`random_rand_s.c
+
 mostlyclean-libtool:
 	-rm -f *.lo
 
@@ -779,9 +897,21 @@ clean-am: clean-generic clean-libLTLIBRARIES clean-libtool \
 	clean-noinstLTLIBRARIES mostlyclean-am
 
 distclean: distclean-am
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_arc4random.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_arc4random_buf.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_dev_urandom.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_getentropy.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_getrandom.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_rand_s.Plo
 	-rm -f ./$(DEPDIR)/libtestpat_la-xmlparse.Plo
 	-rm -f ./$(DEPDIR)/libtestpat_la-xmlrole.Plo
 	-rm -f ./$(DEPDIR)/libtestpat_la-xmltok.Plo
+	-rm -f ./$(DEPDIR)/random_arc4random.Plo
+	-rm -f ./$(DEPDIR)/random_arc4random_buf.Plo
+	-rm -f ./$(DEPDIR)/random_dev_urandom.Plo
+	-rm -f ./$(DEPDIR)/random_getentropy.Plo
+	-rm -f ./$(DEPDIR)/random_getrandom.Plo
+	-rm -f ./$(DEPDIR)/random_rand_s.Plo
 	-rm -f ./$(DEPDIR)/xmlparse.Plo
 	-rm -f ./$(DEPDIR)/xmlrole.Plo
 	-rm -f ./$(DEPDIR)/xmltok.Plo
@@ -831,9 +961,21 @@ install-ps-am:
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_arc4random.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_arc4random_buf.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_dev_urandom.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_getentropy.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_getrandom.Plo
+	-rm -f ./$(DEPDIR)/libtestpat_la-random_rand_s.Plo
 	-rm -f ./$(DEPDIR)/libtestpat_la-xmlparse.Plo
 	-rm -f ./$(DEPDIR)/libtestpat_la-xmlrole.Plo
 	-rm -f ./$(DEPDIR)/libtestpat_la-xmltok.Plo
+	-rm -f ./$(DEPDIR)/random_arc4random.Plo
+	-rm -f ./$(DEPDIR)/random_arc4random_buf.Plo
+	-rm -f ./$(DEPDIR)/random_dev_urandom.Plo
+	-rm -f ./$(DEPDIR)/random_getentropy.Plo
+	-rm -f ./$(DEPDIR)/random_getrandom.Plo
+	-rm -f ./$(DEPDIR)/random_rand_s.Plo
 	-rm -f ./$(DEPDIR)/xmlparse.Plo
 	-rm -f ./$(DEPDIR)/xmlrole.Plo
 	-rm -f ./$(DEPDIR)/xmltok.Plo
diff --git a/lib/expat.h b/lib/expat.h
index 18dbaebde293..79c609f19aa4 100644
--- a/lib/expat.h
+++ b/lib/expat.h
@@ -45,6 +45,7 @@
 #ifndef Expat_INCLUDED
 #  define Expat_INCLUDED 1
 
+#  include <stdint.h> // for uint8_t
 #  include <stdlib.h>
 #  include "expat_external.h"
 
@@ -917,10 +918,21 @@ XML_SetParamEntityParsing(XML_Parser parser,
    function behavior. This must be called before parsing is started.
    Returns 1 if successful, 0 when called after parsing has started.
    Note: If parser == NULL, the function will do nothing and return 0.
+   DEPRECATED since Expat 2.8.0.
 */
 XMLPARSEAPI(int)
 XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt);
 
+/* Sets the hash salt to use for internal hash calculations.
+   Helps in preventing DoS attacks based on predicting hash function behavior.
+   This must be called before parsing is started.
+   Returns XML_TRUE if successful, XML_FALSE when called after parsing has
+   started or when parser is NULL.
+   Added in Expat 2.8.0.
+*/
+XMLPARSEAPI(XML_Bool)
+XML_SetHashSalt16Bytes(XML_Parser parser, const uint8_t entropy[16]);
+
 /* If XML_Parse or XML_ParseBuffer have returned XML_STATUS_ERROR, then
    XML_GetErrorCode returns information about the error.
 */
@@ -1081,8 +1093,8 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
    See https://semver.org
 */
 #  define XML_MAJOR_VERSION 2
-#  define XML_MINOR_VERSION 7
-#  define XML_MICRO_VERSION 5
+#  define XML_MINOR_VERSION 8
+#  define XML_MICRO_VERSION 0
 
 #  ifdef __cplusplus
 }
diff --git a/lib/expat_external.h b/lib/expat_external.h
index d9ddeb612f6d..7f5c4c3aae4d 100644
--- a/lib/expat_external.h
+++ b/lib/expat_external.h
@@ -12,9 +12,10 @@
    Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2016      Cristian Rodríguez <crrodriguez@opensuse.org>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
+   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -45,7 +46,7 @@
 /* Expat tries very hard to make the API boundary very specifically
    defined.  There are two macros defined to control this boundary;
    each of these can be defined before including this header to
-   achieve some different behavior, but doing so it not recommended or
+   achieve some different behavior, but doing so is not recommended or
    tested frequently.
 
    XMLCALL    - The calling convention to use for all calls across the
diff --git a/lib/internal.h b/lib/internal.h
index 61266ebb7723..420d4217a569 100644
--- a/lib/internal.h
+++ b/lib/internal.h
@@ -28,7 +28,7 @@
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2003      Greg Stein <gstein@users.sourceforge.net>
-   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
@@ -113,6 +113,7 @@
 #if defined(_WIN32)                                                            \
     && (! defined(__USE_MINGW_ANSI_STDIO)                                      \
         || (1 - __USE_MINGW_ANSI_STDIO - 1 == 0))
+#  define EXPAT_FMT_LLX(midpart) "%" midpart "I64x"
 #  define EXPAT_FMT_ULL(midpart) "%" midpart "I64u"
 #  if defined(_WIN64) // Note: modifiers "td" and "zu" do not work for MinGW
 #    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "I64d"
@@ -122,6 +123,7 @@
 #    define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
 #  endif
 #else
+#  define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
 #  define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
 #  if ! defined(ULONG_MAX)
 #    error Compiler did not define ULONG_MAX for us
diff --git a/lib/libexpat.map.in b/lib/libexpat.map.in
index 52e59ed3d931..71a6758fd746 100644
--- a/lib/libexpat.map.in
+++ b/lib/libexpat.map.in
@@ -117,3 +117,8 @@ LIBEXPAT_2.7.2 {
 @_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerActivationThreshold;
 @_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerMaximumAmplification;
 } LIBEXPAT_2.6.0;
+
+LIBEXPAT_2.8.0 {
+ global:
+  XML_SetHashSalt16Bytes;
+} LIBEXPAT_2.7.2;
diff --git a/lib/random_arc4random.c b/lib/random_arc4random.c
new file mode 100644
index 000000000000..243fbbc82fda
--- /dev/null
+++ b/lib/random_arc4random.c
@@ -0,0 +1,56 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#include "random_arc4random.h"
+
+#if ! defined(_DEFAULT_SOURCE)
+#  define _DEFAULT_SOURCE 1 /* for glibc */
+#endif
+
+#include <stdint.h> // for uint32_t
+#include <stdlib.h> // for arc4random
+#include <string.h> // for memcpy
+
+void
+writeRandomBytes_arc4random(void *target, size_t count) {
+  size_t bytesWrittenTotal = 0;
+
+  while (bytesWrittenTotal < count) {
+    const uint32_t random32 = arc4random();
+
+    size_t toUse = count - bytesWrittenTotal;
+    if (toUse > sizeof(random32))
+      toUse = sizeof(random32);
+    memcpy((char *)target + bytesWrittenTotal, &random32, toUse);
+    bytesWrittenTotal += toUse;
+  }
+}
diff --git a/tests/acc_tests_cxx.cpp b/lib/random_arc4random.h
index 01644991ae51..54fbd4c4d38e 100644
--- a/tests/acc_tests_cxx.cpp
+++ b/lib/random_arc4random.h
@@ -1,4 +1,4 @@
-/* C++ compilation harness for the test suite.
+/*
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -6,7 +6,7 @@
                         \___/_/\_\ .__/ \__,_|\__|
                                  |_| XML parser
 
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -29,4 +29,11 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "acc_tests.c"
+#if ! defined(RANDOM_ACR4RANDOM_H)
+#  define RANDOM_ACR4RANDOM_H 1
+
+#  include <stddef.h> // for size_t
+
+void writeRandomBytes_arc4random(void *target, size_t count);
+
+#endif // ! defined(RANDOM_ACR4RANDOM_H)
diff --git a/tests/runtests_cxx.cpp b/lib/random_arc4random_buf.c
index 396714560a06..1476f07ba1a2 100644
--- a/tests/runtests_cxx.cpp
+++ b/lib/random_arc4random_buf.c
@@ -1,7 +1,4 @@
-/* C++ compilation harness for the test suite.
-
-   This is used to ensure the Expat headers can be included from C++
-   and have everything work as expected.
+/*
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -9,8 +6,7 @@
                         \___/_/\_\ .__/ \__,_|\__|
                                  |_| XML parser
 
-   Copyright (c) 2005      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
-   Copyright (c) 2017-2023 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -33,4 +29,15 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "runtests.c"
+#include "random_arc4random_buf.h"
+
+#if ! defined(_DEFAULT_SOURCE)
+#  define _DEFAULT_SOURCE 1 /* for glibc */
+#endif
+
+#include <stdlib.h> // for arc4random_buf
+
+void
+writeRandomBytes_arc4random_buf(void *target, size_t count) {
+  arc4random_buf(target, count);
+}
diff --git a/tests/alloc_tests_cxx.cpp b/lib/random_arc4random_buf.h
index 3270b1a6c984..51f7a31f2859 100644
--- a/tests/alloc_tests_cxx.cpp
+++ b/lib/random_arc4random_buf.h
@@ -1,4 +1,4 @@
-/* C++ compilation harness for the test suite.
+/*
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -6,7 +6,7 @@
                         \___/_/\_\ .__/ \__,_|\__|
                                  |_| XML parser
 
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -29,4 +29,11 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "alloc_tests.c"
+#if ! defined(RANDOM_ACR4RANDOM_BUF_H)
+#  define RANDOM_ACR4RANDOM_BUF_H 1
+
+#  include <stddef.h> // for size_t
+
+void writeRandomBytes_arc4random_buf(void *target, size_t count);
+
+#endif // ! defined(RANDOM_ACR4RANDOM_BUF_H)
diff --git a/lib/random_dev_urandom.c b/lib/random_dev_urandom.c
new file mode 100644
index 000000000000..e508fe9f3e3c
--- /dev/null
+++ b/lib/random_dev_urandom.c
@@ -0,0 +1,72 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#include "random_dev_urandom.h"
+
+#if ! defined(_POSIX_C_SOURCE)                                                 \
+    || (defined(_POSIX_C_SOURCE) && (_POSIX_C_SOURCE < 200809L))
+#  define _POSIX_C_SOURCE 200809L // for O_CLOEXEC
+#endif
+
+#include <errno.h>
+#include <fcntl.h>  // open
+#include <unistd.h> // close
+
+/* Extract entropy from /dev/urandom */
+bool
+writeRandomBytes_dev_urandom(void *target, size_t count) {
+  int success = false; /* full count bytes written? */
+  size_t bytesWrittenTotal = 0;
+
+  const int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
+  if (fd < 0) {
+    return 0;
+  }
+
+  do {
+    void *const currentTarget = (void *)((char *)target + bytesWrittenTotal);
+    const size_t bytesToWrite = count - bytesWrittenTotal;
+
+    errno = 0;
+
+    const ssize_t bytesWrittenMore = read(fd, currentTarget, bytesToWrite);
+
+    if (bytesWrittenMore > 0) {
+      bytesWrittenTotal += bytesWrittenMore;
+      if (bytesWrittenTotal >= count)
+        success = true;
+    }
+  } while (! success && (errno == EINTR));
+
+  close(fd);
+  return success;
+}
diff --git a/tests/chardata_cxx.cpp b/lib/random_dev_urandom.h
index 81820c72dca1..d9cf767bff08 100644
--- a/tests/chardata_cxx.cpp
+++ b/lib/random_dev_urandom.h
@@ -1,4 +1,4 @@
-/* C++ compilation harness for the test suite.
+/*
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -6,7 +6,7 @@
                         \___/_/\_\ .__/ \__,_|\__|
                                  |_| XML parser
 
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -29,4 +29,12 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "chardata.c"
+#if ! defined(RANDOM_DEV_URANDOM_H)
+#  define RANDOM_DEV_URANDOM_H 1
+
+#  include <stdbool.h>
+#  include <stddef.h> // for size_t
+
+bool writeRandomBytes_dev_urandom(void *target, size_t count);
+
+#endif // ! defined(RANDOM_DEV_URANDOM_H)
diff --git a/lib/random_getentropy.c b/lib/random_getentropy.c
new file mode 100644
index 000000000000..b4be70ed73c1
--- /dev/null
+++ b/lib/random_getentropy.c
@@ -0,0 +1,54 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#include "random_getentropy.h"
+
+// NOTE: Please keep this block in sync with its two siblings in files
+//       `configure.ac` and `ConfigureChecks.cmake`!
+#if defined(__APPLE__)
+#  include <sys/random.h>
+#else
+#  if defined(__GLIBC__) && ! defined(_DEFAULT_SOURCE)
+#    define _DEFAULT_SOURCE 1
+#  endif
+#  if ! defined(_GNU_SOURCE)
+#    define _GNU_SOURCE 1 /* for musl */
+#  endif
+#  include <unistd.h>
+#endif // ! defined(__APPLE__)
+
+#include <errno.h>
+
+bool
+writeRandomBytes_getentropy(void *target, size_t count) {
+  errno = 0;
+  return getentropy(target, count) == 0;
+}
diff --git a/tests/basic_tests_cxx.cpp b/lib/random_getentropy.h
index d7e75a9061cf..a00b16bfb33d 100644
--- a/tests/basic_tests_cxx.cpp
+++ b/lib/random_getentropy.h
@@ -1,4 +1,4 @@
-/* C++ compilation harness for the test suite.
+/*
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -6,7 +6,7 @@
                         \___/_/\_\ .__/ \__,_|\__|
                                  |_| XML parser
 
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -29,4 +29,12 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "basic_tests.c"
+#if ! defined(RANDOM_GETENTROPY_H)
+#  define RANDOM_GETENTROPY_H 1
+
+#  include <stdbool.h>
+#  include <stddef.h> // for size_t
+
+bool writeRandomBytes_getentropy(void *target, size_t count);
+
+#endif // ! defined(RANDOM_GETENTROPY_H)
diff --git a/lib/random_getrandom.c b/lib/random_getrandom.c
new file mode 100644
index 000000000000..e5724a211cc6
--- /dev/null
+++ b/lib/random_getrandom.c
@@ -0,0 +1,90 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2017      Chanho Park <chanho61.park@samsung.com>
+   Copyright (c) 2022      Sean McBride <sean@rogue-research.com>
+   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#include "random_getrandom.h"
+
+#include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM
+
+#if defined(HAVE_GETRANDOM)
+#  include <sys/random.h> /* getrandom */
+#endif
+
+#if defined(HAVE_SYSCALL_GETRANDOM)
+#  if ! defined(_GNU_SOURCE)
+#    define _GNU_SOURCE 1 /* syscall prototype */
+#  endif
+#  include <unistd.h>      /* syscall */
+#  include <sys/syscall.h> /* SYS_getrandom */
+#endif                     // defined(HAVE_SYSCALL_GETRANDOM)
+
+#if ! defined(GRND_NONBLOCK)
+#  define GRND_NONBLOCK 0x0001
+#endif /* defined(GRND_NONBLOCK) */
+
+#include <assert.h>
+#include <errno.h>
+#include <limits.h> // for INT_MAX
+
+/* Obtain entropy on Linux 3.17+ */
+bool
+writeRandomBytes_getrandom_nonblock(void *target, size_t count) {
+  int success = false; /* full count bytes written? */
+  size_t bytesWrittenTotal = 0;
+  const unsigned int getrandomFlags = GRND_NONBLOCK;
+
+  do {
+    void *const currentTarget = (void *)((char *)target + bytesWrittenTotal);
+    const size_t bytesToWrite = count - bytesWrittenTotal;
+
+    assert(bytesToWrite <= INT_MAX);
+
+    errno = 0;
+
+    const int bytesWrittenMore =
+#if defined(HAVE_GETRANDOM)
+        (int)getrandom(currentTarget, bytesToWrite, getrandomFlags);
+#else
+        (int)syscall(SYS_getrandom, currentTarget, bytesToWrite,
+                     getrandomFlags);
+#endif
+
+    if (bytesWrittenMore > 0) {
+      bytesWrittenTotal += bytesWrittenMore;
+      if (bytesWrittenTotal >= count)
+        success = true;
+    }
+  } while (! success && (errno == EINTR));
+
+  return success;
+}
diff --git a/lib/random_getrandom.h b/lib/random_getrandom.h
new file mode 100644
index 000000000000..ed4d829cd0d6
--- /dev/null
+++ b/lib/random_getrandom.h
@@ -0,0 +1,40 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#if ! defined(RANDOM_GETRANDOM_H)
+#  define RANDOM_GETRANDOM_H 1
+
+#  include <stdbool.h>
+#  include <stddef.h> // for size_t
+
+bool writeRandomBytes_getrandom_nonblock(void *target, size_t count);
+
+#endif // ! defined(RANDOM_GETRANDOM_H)
diff --git a/lib/random_rand_s.c b/lib/random_rand_s.c
new file mode 100644
index 000000000000..46156563c91c
--- /dev/null
+++ b/lib/random_rand_s.c
@@ -0,0 +1,88 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
+   Copyright (c) 2019-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2019      Ben Wagner <bungeman@chromium.org>
+   Copyright (c) 2019      Vadim Zeitlin <vadim@zeitlins.org>
+   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#include "random_rand_s.h"
+
+/* force stdlib to define rand_s() */
+#if ! defined(_CRT_RAND_S)
+#  define _CRT_RAND_S
+#endif
+
+// Workaround MinGW GCC trouble with recognizing `rand_s`, likely related
+// to return type `error_t`; the symptom was:
+// > error: implicit declaration of function ‘rand_s’
+#if defined(__MINGW32__)
+#  include <errno.h>
+#endif
+
+#include <stdlib.h> // for rand_s
+#include <string.h> // for memcpy
+
+// Help clang-tidy out with prototype of function `rand_s`
+#if defined(XML_CLANG_TIDY)
+int rand_s(unsigned int *);
+#endif
+
+/* Provide declaration of rand_s() for MinGW-32 (not 64, which has it),
+   as it didn't declare it in its header prior to version 5.3.0 of its
+   runtime package (mingwrt, containing stdlib.h).  The upstream fix
+   was introduced at https://osdn.net/projects/mingw/ticket/39658 . */
+#if defined(__MINGW32__) && defined(__MINGW32_VERSION)                         \
+    && __MINGW32_VERSION < 5003000L && ! defined(__MINGW64_VERSION_MAJOR)
+__declspec(dllimport) int rand_s(unsigned int *);
+#endif
+
+/* Obtain entropy on Windows using the rand_s() function which
+ * generates cryptographically secure random numbers.  Internally it
+ * uses RtlGenRandom API which is present in Windows XP and later.
+ */
+bool
+writeRandomBytes_rand_s(void *target, size_t count) {
+  size_t bytesWrittenTotal = 0;
+
+  while (bytesWrittenTotal < count) {
+    unsigned int random32 = 0;
+
+    if (rand_s(&random32))
+      return false; /* failure */
+
+    size_t toUse = count - bytesWrittenTotal;
+    if (toUse > sizeof(random32))
+      toUse = sizeof(random32);
+    memcpy((char *)target + bytesWrittenTotal, &random32, toUse);
+    bytesWrittenTotal += toUse;
+  }
+  return true; /* success */
+}
diff --git a/lib/random_rand_s.h b/lib/random_rand_s.h
new file mode 100644
index 000000000000..2b487d62a7c5
--- /dev/null
+++ b/lib/random_rand_s.h
@@ -0,0 +1,41 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2019 David Loffredo <loffredo@steptools.com>
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#if ! defined(RANDOM_RAND_S_H)
+#  define RANDOM_RAND_S_H 1
+
+#  include <stdbool.h>
+#  include <stddef.h> // for size_t
+
+bool writeRandomBytes_rand_s(void *target, size_t count);
+
+#endif // ! defined(RANDOM_RAND_S_H)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 0248b6651ffb..620d1e4b46e2 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -1,4 +1,4 @@
-/* 93c1caa66e2b0310459482516af05505b57c5cb7b96df777105308fc585c85d1 (2.7.5+)
+/* a5d18f6a50f536615ac1c70304f87d94f99cc85a86b502188952440610ccf0f8 (2.8.0+)
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -41,10 +41,12 @@
    Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
    Copyright (c) 2024-2025 Berkay Eren Ürün <berkay.ueruen@siemens.com>
    Copyright (c) 2024      Hanno Böck <hanno@gentoo.org>
-   Copyright (c) 2025      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Copyright (c) 2025-2026 Matthew Fernandez <matthew.fernandez@gmail.com>
    Copyright (c) 2025      Atrem Borovik <polzovatellllk@gmail.com>
    Copyright (c) 2025      Alfonso Gregory <gfunni234@gmail.com>
    Copyright (c) 2026      Rosen Penev <rosenp@gmail.com>
+   Copyright (c) 2026      Francesco Bertolaccini
+   Copyright (c) 2026      Christian Ng <christianrng@berkeley.edu>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -84,28 +86,16 @@
 #  error XML_CONTEXT_BYTES must be defined, non-empty and >=0 (0 to disable, >=1 to enable; 1024 is a common default)
 #endif
 
-#if defined(HAVE_SYSCALL_GETRANDOM)
-#  if ! defined(_GNU_SOURCE)
-#    define _GNU_SOURCE 1 /* syscall prototype */
-#  endif
-#endif
-
-#ifdef _WIN32
-/* force stdlib to define rand_s() */
-#  if ! defined(_CRT_RAND_S)
-#    define _CRT_RAND_S
-#  endif
-#endif
-
 #include <stdbool.h>
 #include <stddef.h>
 #include <string.h> /* memset(), memcpy() */
 #include <assert.h>
 #include <limits.h> /* INT_MAX, UINT_MAX */
 #include <stdio.h>  /* fprintf */
-#include <stdlib.h> /* getenv, rand_s */
+#include <stdlib.h> /* getenv */
 #include <stdint.h> /* SIZE_MAX, uintptr_t */
 #include <math.h>   /* isnan */
+#include <errno.h>
 
 #ifdef _WIN32
 #  define getpid GetCurrentProcessId
@@ -125,26 +115,34 @@
 #include "expat.h"
 #include "siphash.h"
 
+#if defined(HAVE_ARC4RANDOM)
+#  include "random_arc4random.h"
+#endif /* defined(HAVE_ARC4RANDOM) */
+
+#if defined(HAVE_ARC4RANDOM_BUF)
+#  include "random_arc4random_buf.h"
+#endif // defined(HAVE_ARC4RANDOM_BUF)
+
+#if defined(XML_DEV_URANDOM)
+#  include "random_dev_urandom.h"
+#endif /* defined(XML_DEV_URANDOM) */
+
+#if defined(HAVE_GETENTROPY)
+#  include "random_getentropy.h"
+#endif // defined(HAVE_GETENTROPY)
+
 #if defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM)
-#  if defined(HAVE_GETRANDOM)
-#    include <sys/random.h> /* getrandom */
-#  else
-#    include <unistd.h>      /* syscall */
-#    include <sys/syscall.h> /* SYS_getrandom */
-#  endif
-#  if ! defined(GRND_NONBLOCK)
-#    define GRND_NONBLOCK 0x0001
-#  endif /* defined(GRND_NONBLOCK) */
-#endif   /* defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM) */
+#  include "random_getrandom.h"
+#endif /* defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM) */
 
-#if defined(_WIN32) && ! defined(LOAD_LIBRARY_SEARCH_SYSTEM32)
-#  define LOAD_LIBRARY_SEARCH_SYSTEM32 0x00000800
-#endif
+#if defined(_WIN32)
+#  include "random_rand_s.h"
+#endif /* defined(_WIN32) */
 
 #if ! defined(HAVE_GETRANDOM) && ! defined(HAVE_SYSCALL_GETRANDOM)             \
     && ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM)            \
-    && ! defined(XML_DEV_URANDOM) && ! defined(_WIN32)                         \
-    && ! defined(XML_POOR_ENTROPY)
+    && ! defined(HAVE_GETENTROPY) && ! defined(XML_DEV_URANDOM)                \
+    && ! defined(_WIN32) && ! defined(XML_POOR_ENTROPY)
 #  error You do not have support for any sources of high quality entropy \
     enabled.  For end user security, that is probably not what you want. \
     \
@@ -153,10 +151,11 @@
       * Linux >=3.17 + glibc (including <2.25) (syscall SYS_getrandom): HAVE_SYSCALL_GETRANDOM, \
       * BSD / macOS >=10.7 / glibc >=2.36 (arc4random_buf): HAVE_ARC4RANDOM_BUF, \
       * BSD / macOS (including <10.7) / glibc >=2.36 (arc4random): HAVE_ARC4RANDOM, \
+      * BSD / macOS >=10.12 / glibc >=2.25 (getentropy): HAVE_GETENTROPY, \
       * Linux (including <3.17) / BSD / macOS (including <10.7) / Solaris >=8 (/dev/urandom): XML_DEV_URANDOM, \
       * Windows >=Vista (rand_s): _WIN32. \
     \
-    If insist on not using any of these, bypass this error by defining \
+    If you insist on not using any of these, bypass this error by defining \
     XML_POOR_ENTROPY; you have been warned. \
     \
     If you have reasons to patch this detection code away or need changes \
@@ -604,7 +603,7 @@ static ELEMENT_TYPE *getElementType(XML_Parser parser, const ENCODING *enc,
 
 static XML_Char *copyString(const XML_Char *s, XML_Parser parser);
 
-static unsigned long generate_hash_secret_salt(XML_Parser parser);
+static struct sipkey generate_hash_secret_salt(void);
 static XML_Bool startParsing(XML_Parser parser);
 
 static XML_Parser parserCreate(const XML_Char *encodingName,
@@ -777,7 +776,8 @@ struct XML_ParserStruct {
   XML_Bool m_useForeignDTD;
   enum XML_ParamEntityParsing m_paramEntityParsing;
 #endif
-  unsigned long m_hash_secret_salt;
+  struct sipkey m_hash_secret_salt_128;
+  XML_Bool m_hash_secret_salt_set;
 #if XML_GE == 1
   ACCOUNTING m_accounting;
   MALLOC_TRACKER m_alloc_tracker;
@@ -1036,135 +1036,6 @@ static const XML_Char implicitContext[]
        ASCII_s,     ASCII_p,     ASCII_a,      ASCII_c,      ASCII_e,
        '\0'};
 
-/* To avoid warnings about unused functions: */
-#if ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM)
-
-#  if defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM)
-
-/* Obtain entropy on Linux 3.17+ */
-static int
-writeRandomBytes_getrandom_nonblock(void *target, size_t count) {
-  int success = 0; /* full count bytes written? */
-  size_t bytesWrittenTotal = 0;
-  const unsigned int getrandomFlags = GRND_NONBLOCK;
-
-  do {
-    void *const currentTarget = (void *)((char *)target + bytesWrittenTotal);
-    const size_t bytesToWrite = count - bytesWrittenTotal;
-
-    assert(bytesToWrite <= INT_MAX);
-
-    const int bytesWrittenMore =
-#    if defined(HAVE_GETRANDOM)
-        (int)getrandom(currentTarget, bytesToWrite, getrandomFlags);
-#    else
-        (int)syscall(SYS_getrandom, currentTarget, bytesToWrite,
-                     getrandomFlags);
-#    endif
-
-    if (bytesWrittenMore > 0) {
-      bytesWrittenTotal += bytesWrittenMore;
-      if (bytesWrittenTotal >= count)
-        success = 1;
-    }
-  } while (! success && (errno == EINTR));
-
-  return success;
-}
-
-#  endif /* defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM) */
-
-#  if ! defined(_WIN32) && defined(XML_DEV_URANDOM)
-
-/* Extract entropy from /dev/urandom */
-static int
-writeRandomBytes_dev_urandom(void *target, size_t count) {
-  int success = 0; /* full count bytes written? */
-  size_t bytesWrittenTotal = 0;
-
-  const int fd = open("/dev/urandom", O_RDONLY);
-  if (fd < 0) {
-    return 0;
-  }
-
-  do {
-    void *const currentTarget = (void *)((char *)target + bytesWrittenTotal);
-    const size_t bytesToWrite = count - bytesWrittenTotal;
-
-    const ssize_t bytesWrittenMore = read(fd, currentTarget, bytesToWrite);
-
-    if (bytesWrittenMore > 0) {
-      bytesWrittenTotal += bytesWrittenMore;
-      if (bytesWrittenTotal >= count)
-        success = 1;
-    }
-  } while (! success && (errno == EINTR));
-
-  close(fd);
-  return success;
-}
-
-#  endif /* ! defined(_WIN32) && defined(XML_DEV_URANDOM) */
-
-#endif /* ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM) */
-
-#if defined(HAVE_ARC4RANDOM) && ! defined(HAVE_ARC4RANDOM_BUF)
-
-static void
-writeRandomBytes_arc4random(void *target, size_t count) {
-  size_t bytesWrittenTotal = 0;
-
-  while (bytesWrittenTotal < count) {
-    const uint32_t random32 = arc4random();
-    size_t i = 0;
-
-    for (; (i < sizeof(random32)) && (bytesWrittenTotal < count);
-         i++, bytesWrittenTotal++) {
-      const uint8_t random8 = (uint8_t)(random32 >> (i * 8));
-      ((uint8_t *)target)[bytesWrittenTotal] = random8;
-    }
-  }
-}
-
-#endif /* defined(HAVE_ARC4RANDOM) && ! defined(HAVE_ARC4RANDOM_BUF) */
-
-#ifdef _WIN32
-
-/* Provide declaration of rand_s() for MinGW-32 (not 64, which has it),
-   as it didn't declare it in its header prior to version 5.3.0 of its
-   runtime package (mingwrt, containing stdlib.h).  The upstream fix
-   was introduced at https://osdn.net/projects/mingw/ticket/39658 . */
-#  if defined(__MINGW32__) && defined(__MINGW32_VERSION)                       \
-      && __MINGW32_VERSION < 5003000L && ! defined(__MINGW64_VERSION_MAJOR)
-__declspec(dllimport) int rand_s(unsigned int *);
-#  endif
-
-/* Obtain entropy on Windows using the rand_s() function which
- * generates cryptographically secure random numbers.  Internally it
- * uses RtlGenRandom API which is present in Windows XP and later.
- */
-static int
-writeRandomBytes_rand_s(void *target, size_t count) {
-  size_t bytesWrittenTotal = 0;
-
-  while (bytesWrittenTotal < count) {
-    unsigned int random32 = 0;
-    size_t i = 0;
-
-    if (rand_s(&random32))
-      return 0; /* failure */
-
-    for (; (i < sizeof(random32)) && (bytesWrittenTotal < count);
-         i++, bytesWrittenTotal++) {
-      const uint8_t random8 = (uint8_t)(random32 >> (i * 8));
-      ((uint8_t *)target)[bytesWrittenTotal] = random8;
-    }
-  }
-  return 1; /* success */
-}
-
-#endif /* _WIN32 */
-
 #if ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM)
 
 static unsigned long
@@ -1192,69 +1063,70 @@ gather_time_entropy(void) {
 
 #endif /* ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM) */
 
-static unsigned long
-ENTROPY_DEBUG(const char *label, unsigned long entropy) {
+static struct sipkey
+ENTROPY_DEBUG(const char *label, struct sipkey entropy_128) {
   if (getDebugLevel("EXPAT_ENTROPY_DEBUG", 0) >= 1u) {
-    fprintf(stderr, "expat: Entropy: %s --> 0x%0*lx (%lu bytes)\n", label,
-            (int)sizeof(entropy) * 2, entropy, (unsigned long)sizeof(entropy));
+    fprintf(stderr,
+            "expat: Entropy: %s --> [0x" EXPAT_FMT_LLX(
+                "016") ", 0x" EXPAT_FMT_LLX("016") "] (16 bytes)\n",
+            label, (unsigned long long)entropy_128.k[0],
+            (unsigned long long)entropy_128.k[1]);
   }
-  return entropy;
+  return entropy_128;
 }
 
-static unsigned long
-generate_hash_secret_salt(XML_Parser parser) {
-  unsigned long entropy;
-  (void)parser;
+static struct sipkey
+generate_hash_secret_salt(void) {
+  struct sipkey entropy;
 
   /* "Failproof" high quality providers: */
 #if defined(HAVE_ARC4RANDOM_BUF)
-  arc4random_buf(&entropy, sizeof(entropy));
+  writeRandomBytes_arc4random_buf(&entropy, sizeof(entropy));
   return ENTROPY_DEBUG("arc4random_buf", entropy);
 #elif defined(HAVE_ARC4RANDOM)
-  writeRandomBytes_arc4random((void *)&entropy, sizeof(entropy));
+  writeRandomBytes_arc4random(&entropy, sizeof(entropy));
   return ENTROPY_DEBUG("arc4random", entropy);
 #else
   /* Try high quality providers first .. */
 #  ifdef _WIN32
-  if (writeRandomBytes_rand_s((void *)&entropy, sizeof(entropy))) {
+  if (writeRandomBytes_rand_s(&entropy, sizeof(entropy))) {
     return ENTROPY_DEBUG("rand_s", entropy);
   }
+#  elif defined(HAVE_GETENTROPY)
+  if (writeRandomBytes_getentropy(&entropy, sizeof(entropy))) {
+    return ENTROPY_DEBUG("getentropy", entropy);
+  }
+  errno = 0;
 #  elif defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM)
-  if (writeRandomBytes_getrandom_nonblock((void *)&entropy, sizeof(entropy))) {
+  if (writeRandomBytes_getrandom_nonblock(&entropy, sizeof(entropy))) {
     return ENTROPY_DEBUG("getrandom", entropy);
   }
 #  endif
 #  if ! defined(_WIN32) && defined(XML_DEV_URANDOM)
-  if (writeRandomBytes_dev_urandom((void *)&entropy, sizeof(entropy))) {
+  if (writeRandomBytes_dev_urandom(&entropy, sizeof(entropy))) {
     return ENTROPY_DEBUG("/dev/urandom", entropy);
   }
 #  endif /* ! defined(_WIN32) && defined(XML_DEV_URANDOM) */
   /* .. and self-made low quality for backup: */
 
-  entropy = gather_time_entropy();
+  entropy.k[0] = 0;
+  entropy.k[1] = gather_time_entropy();
 #  if ! defined(__wasi__)
   /* Process ID is 0 bits entropy if attacker has local access */
-  entropy ^= getpid();
+  entropy.k[1] ^= getpid();
 #  endif
 
   /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */
   if (sizeof(unsigned long) == 4) {
-    return ENTROPY_DEBUG("fallback(4)", entropy * 2147483647);
+    entropy.k[1] *= 2147483647;
+    return ENTROPY_DEBUG("fallback(4)", entropy);
   } else {
-    return ENTROPY_DEBUG("fallback(8)",
-                         entropy * (unsigned long)2305843009213693951ULL);
+    entropy.k[1] *= 2305843009213693951ULL;
+    return ENTROPY_DEBUG("fallback(8)", entropy);
   }
 #endif
 }
 
-static unsigned long
-get_hash_secret_salt(XML_Parser parser) {
-  const XML_Parser rootParser = getRootParserOf(parser, NULL);
-  assert(! rootParser->m_parentParser);
-
-  return rootParser->m_hash_secret_salt;
-}
-
 static enum XML_Error
 callProcessor(XML_Parser parser, const char *start, const char *end,
               const char **endPtr) {
@@ -1323,8 +1195,10 @@ callProcessor(XML_Parser parser, const char *start, const char *end,
 static XML_Bool /* only valid for root parser */
 startParsing(XML_Parser parser) {
   /* hash functions must be initialized before setContext() is called */
-  if (parser->m_hash_secret_salt == 0)
-    parser->m_hash_secret_salt = generate_hash_secret_salt(parser);
+  if (parser->m_hash_secret_salt_set != XML_TRUE) {
+    parser->m_hash_secret_salt_128 = generate_hash_secret_salt();
+    parser->m_hash_secret_salt_set = XML_TRUE;
+  }
   if (parser->m_ns) {
     /* implicit context only set for root parser, since child
        parsers (i.e. external entity parsers) will inherit it
@@ -1612,7 +1486,9 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) {
   parser->m_useForeignDTD = XML_FALSE;
   parser->m_paramEntityParsing = XML_PARAM_ENTITY_PARSING_NEVER;
 #endif
-  parser->m_hash_secret_salt = 0;
+  parser->m_hash_secret_salt_128.k[0] = 0;
+  parser->m_hash_secret_salt_128.k[1] = 0;
+  parser->m_hash_secret_salt_set = XML_FALSE;
 
 #if XML_GE == 1
   memset(&parser->m_accounting, 0, sizeof(ACCOUNTING));
@@ -1779,7 +1655,8 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
      from hash tables associated with either parser without us having
      to worry which hash secrets each table has.
   */
-  unsigned long oldhash_secret_salt;
+  struct sipkey oldhash_secret_salt_128;
+  XML_Bool oldhash_secret_salt_set;
   XML_Bool oldReparseDeferralEnabled;
 
   /* Validate the oldParser parameter before we pull everything out of it */
@@ -1825,7 +1702,8 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
      from hash tables associated with either parser without us having
      to worry which hash secrets each table has.
   */
-  oldhash_secret_salt = parser->m_hash_secret_salt;
+  oldhash_secret_salt_128 = parser->m_hash_secret_salt_128;
+  oldhash_secret_salt_set = parser->m_hash_secret_salt_set;
   oldReparseDeferralEnabled = parser->m_reparseDeferralEnabled;
 
 #ifdef XML_DTD
@@ -1880,7 +1758,8 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
     parser->m_externalEntityRefHandlerArg = oldExternalEntityRefHandlerArg;
   parser->m_defaultExpandInternalEntities = oldDefaultExpandInternalEntities;
   parser->m_ns_triplets = oldns_triplets;
-  parser->m_hash_secret_salt = oldhash_secret_salt;
+  parser->m_hash_secret_salt_128 = oldhash_secret_salt_128;
+  parser->m_hash_secret_salt_set = oldhash_secret_salt_set;
   parser->m_reparseDeferralEnabled = oldReparseDeferralEnabled;
   parser->m_parentParser = oldParser;
 #ifdef XML_DTD
@@ -2324,6 +2203,7 @@ XML_SetParamEntityParsing(XML_Parser parser,
 #endif
 }
 
+// DEPRECATED since Expat 2.8.0.
 int XMLCALL
 XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt) {
   if (parser == NULL)
@@ -2335,10 +2215,46 @@ XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt) {
   /* block after XML_Parse()/XML_ParseBuffer() has been called */
   if (parserBusy(rootParser))
     return 0;
-  rootParser->m_hash_secret_salt = hash_salt;
+
+  rootParser->m_hash_secret_salt_128.k[0] = 0;
+  rootParser->m_hash_secret_salt_128.k[1] = hash_salt;
+
+  if (hash_salt != 0) { // to remain backwards compatible
+    rootParser->m_hash_secret_salt_set = XML_TRUE;
+
+    if (sizeof(unsigned long) == 4)
+      ENTROPY_DEBUG("explicit(4)", rootParser->m_hash_secret_salt_128);
+    else
+      ENTROPY_DEBUG("explicit(8)", rootParser->m_hash_secret_salt_128);
+  }
+
   return 1;
 }
 
+XML_Bool XMLCALL
+XML_SetHashSalt16Bytes(XML_Parser parser, const uint8_t entropy[16]) {
+  if (parser == NULL)
+    return XML_FALSE;
+
+  if (entropy == NULL)
+    return XML_FALSE;
+
+  const XML_Parser rootParser = getRootParserOf(parser, NULL);
+  assert(! rootParser->m_parentParser);
+
+  /* block after XML_Parse()/XML_ParseBuffer() has been called */
+  if (parserBusy(rootParser))
+    return XML_FALSE;
+
+  sip_tokey(&(rootParser->m_hash_secret_salt_128), entropy);
+
+  rootParser->m_hash_secret_salt_set = XML_TRUE;
+
+  ENTROPY_DEBUG("explicit(16)", rootParser->m_hash_secret_salt_128);
+
+  return XML_TRUE;
+}
+
 enum XML_Status XMLCALL
 XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
   if ((parser == NULL) || (len < 0) || ((s == NULL) && (len != 0))) {
@@ -7842,8 +7758,10 @@ keylen(KEY s) {
 
 static void
 copy_salt_to_sipkey(XML_Parser parser, struct sipkey *key) {
-  key->k[0] = 0;
-  key->k[1] = get_hash_secret_salt(parser);
+  const XML_Parser rootParser = getRootParserOf(parser, NULL);
+  assert(! rootParser->m_parentParser);
+
+  *key = rootParser->m_hash_secret_salt_128;
 }
 
 static unsigned long FASTCALL
diff --git a/lib/xmlrole.c b/lib/xmlrole.c
index b1dfb456e5df..d56bee82dd2d 100644
--- a/lib/xmlrole.c
+++ b/lib/xmlrole.c
@@ -12,7 +12,7 @@
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2005-2009 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2023 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2021      Donghee Na <donghee.na@python.org>
diff --git a/lib/xmltok.c b/lib/xmltok.c
index f6e5f742c928..32cd5f147e93 100644
--- a/lib/xmltok.c
+++ b/lib/xmltok.c
@@ -12,7 +12,7 @@
    Copyright (c) 2002      Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2005-2009 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2016      Pascal Cuoq <cuoq@trust-in-soft.com>
    Copyright (c) 2016      Don Lewis <truckman@apache.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
diff --git a/lib/xmltok_ns.c b/lib/xmltok_ns.c
index 1cd60de1e4fe..810ca2c6d048 100644
--- a/lib/xmltok_ns.c
+++ b/lib/xmltok_ns.c
@@ -11,7 +11,7 @@
    Copyright (c) 2002      Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2025      Alfonso Gregory <gfunni234@gmail.com>
    Licensed under the MIT license:
 
diff --git a/tests/Makefile.am b/tests/Makefile.am
index d25376be5419..eefcfe023501 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2024 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017-2022 Rhodri James <rhodri@wildebeest.org.uk>
 # Copyright (c) 2020      Jeffrey Walton <noloader@gmail.com>
 # Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
@@ -35,8 +35,8 @@ SUBDIRS = . benchmark
 
 AM_CPPFLAGS = @AM_CPPFLAGS@ -I$(srcdir)/../lib -DXML_TESTING
 
-check_PROGRAMS = runtests runtests_cxx
-TESTS = runtests runtests_cxx
+check_PROGRAMS = runtests
+TESTS = runtests
 
 # To support MinGW and Non-MinGW at the same time:
 LOG_DRIVER = $(srcdir)/../test-driver-wrapper.sh
@@ -57,27 +57,9 @@ runtests_SOURCES = \
     runtests.c \
     structdata.c
 
-runtests_cxx_SOURCES = \
-    acc_tests_cxx.cpp \
-    alloc_tests_cxx.cpp \
-    basic_tests_cxx.cpp \
-    chardata_cxx.cpp \
-    common_cxx.cpp \
-    dummy_cxx.cpp \
-    handlers_cxx.cpp \
-    memcheck_cxx.cpp \
-    minicheck_cxx.cpp \
-    misc_tests_cxx.cpp \
-    nsalloc_tests_cxx.cpp \
-    ns_tests_cxx.cpp \
-    runtests_cxx.cpp \
-    structdata_cxx.cpp
-
 runtests_LDADD = ../lib/libtestpat.la
-runtests_cxx_LDADD = ../lib/libtestpat.la
 
 runtests_LDFLAGS = @AM_LDFLAGS@ @LIBM@
-runtests_cxx_LDFLAGS = @AM_LDFLAGS@ @LIBM@
 
 EXTRA_DIST = \
     acc_tests.h \
diff --git a/tests/Makefile.in b/tests/Makefile.in
index 9ffb46a09c75..97b22713663f 100644
--- a/tests/Makefile.in
+++ b/tests/Makefile.in
@@ -22,7 +22,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2024 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017-2022 Rhodri James <rhodri@wildebeest.org.uk>
 # Copyright (c) 2020      Jeffrey Walton <noloader@gmail.com>
 # Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
@@ -122,8 +122,8 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
-check_PROGRAMS = runtests$(EXEEXT) runtests_cxx$(EXEEXT)
-TESTS = runtests$(EXEEXT) runtests_cxx$(EXEEXT)
+check_PROGRAMS = runtests$(EXEEXT)
+TESTS = runtests$(EXEEXT)
 subdir = tests
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
@@ -162,19 +162,6 @@ am__v_lt_1 =
 runtests_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
 	$(runtests_LDFLAGS) $(LDFLAGS) -o $@
-am_runtests_cxx_OBJECTS = acc_tests_cxx.$(OBJEXT) \
-	alloc_tests_cxx.$(OBJEXT) basic_tests_cxx.$(OBJEXT) \
-	chardata_cxx.$(OBJEXT) common_cxx.$(OBJEXT) \
-	dummy_cxx.$(OBJEXT) handlers_cxx.$(OBJEXT) \
-	memcheck_cxx.$(OBJEXT) minicheck_cxx.$(OBJEXT) \
-	misc_tests_cxx.$(OBJEXT) nsalloc_tests_cxx.$(OBJEXT) \
-	ns_tests_cxx.$(OBJEXT) runtests_cxx.$(OBJEXT) \
-	structdata_cxx.$(OBJEXT)
-runtests_cxx_OBJECTS = $(am_runtests_cxx_OBJECTS)
-runtests_cxx_DEPENDENCIES = ../lib/libtestpat.la
-runtests_cxx_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CXX $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=link $(CXXLD) $(AM_CXXFLAGS) \
-	$(CXXFLAGS) $(runtests_cxx_LDFLAGS) $(LDFLAGS) -o $@
 AM_V_P = $(am__v_P_@AM_V@)
 am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
 am__v_P_0 = false
@@ -191,20 +178,13 @@ DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/conftools/depcomp
 am__maybe_remake_depfiles = depfiles
 am__depfiles_remade = ./$(DEPDIR)/acc_tests.Po \
-	./$(DEPDIR)/acc_tests_cxx.Po ./$(DEPDIR)/alloc_tests.Po \
-	./$(DEPDIR)/alloc_tests_cxx.Po ./$(DEPDIR)/basic_tests.Po \
-	./$(DEPDIR)/basic_tests_cxx.Po ./$(DEPDIR)/chardata.Po \
-	./$(DEPDIR)/chardata_cxx.Po ./$(DEPDIR)/common.Po \
-	./$(DEPDIR)/common_cxx.Po ./$(DEPDIR)/dummy.Po \
-	./$(DEPDIR)/dummy_cxx.Po ./$(DEPDIR)/handlers.Po \
-	./$(DEPDIR)/handlers_cxx.Po ./$(DEPDIR)/memcheck.Po \
-	./$(DEPDIR)/memcheck_cxx.Po ./$(DEPDIR)/minicheck.Po \
-	./$(DEPDIR)/minicheck_cxx.Po ./$(DEPDIR)/misc_tests.Po \
-	./$(DEPDIR)/misc_tests_cxx.Po ./$(DEPDIR)/ns_tests.Po \
-	./$(DEPDIR)/ns_tests_cxx.Po ./$(DEPDIR)/nsalloc_tests.Po \
-	./$(DEPDIR)/nsalloc_tests_cxx.Po ./$(DEPDIR)/runtests.Po \
-	./$(DEPDIR)/runtests_cxx.Po ./$(DEPDIR)/structdata.Po \
-	./$(DEPDIR)/structdata_cxx.Po
+	./$(DEPDIR)/alloc_tests.Po ./$(DEPDIR)/basic_tests.Po \
+	./$(DEPDIR)/chardata.Po ./$(DEPDIR)/common.Po \
+	./$(DEPDIR)/dummy.Po ./$(DEPDIR)/handlers.Po \
+	./$(DEPDIR)/memcheck.Po ./$(DEPDIR)/minicheck.Po \
+	./$(DEPDIR)/misc_tests.Po ./$(DEPDIR)/ns_tests.Po \
+	./$(DEPDIR)/nsalloc_tests.Po ./$(DEPDIR)/runtests.Po \
+	./$(DEPDIR)/structdata.Po
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -224,26 +204,8 @@ AM_V_CCLD = $(am__v_CCLD_@AM_V@)
 am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
 am__v_CCLD_0 = @echo "  CCLD    " $@;
 am__v_CCLD_1 = 
-CXXCOMPILE = $(CXX) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
-	$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CXXFLAGS) $(CXXFLAGS)
-LTCXXCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CXX $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=compile $(CXX) $(DEFS) \
-	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
-	$(AM_CXXFLAGS) $(CXXFLAGS)
-AM_V_CXX = $(am__v_CXX_@AM_V@)
-am__v_CXX_ = $(am__v_CXX_@AM_DEFAULT_V@)
-am__v_CXX_0 = @echo "  CXX     " $@;
-am__v_CXX_1 = 
-CXXLD = $(CXX)
-CXXLINK = $(LIBTOOL) $(AM_V_lt) --tag=CXX $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=link $(CXXLD) $(AM_CXXFLAGS) \
-	$(CXXFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
-AM_V_CXXLD = $(am__v_CXXLD_@AM_V@)
-am__v_CXXLD_ = $(am__v_CXXLD_@AM_DEFAULT_V@)
-am__v_CXXLD_0 = @echo "  CXXLD   " $@;
-am__v_CXXLD_1 = 
-SOURCES = $(runtests_SOURCES) $(runtests_cxx_SOURCES)
-DIST_SOURCES = $(runtests_SOURCES) $(runtests_cxx_SOURCES)
+SOURCES = $(runtests_SOURCES)
+DIST_SOURCES = $(runtests_SOURCES)
 RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
 	ctags-recursive dvi-recursive html-recursive info-recursive \
 	install-data-recursive install-dvi-recursive \
@@ -695,26 +657,8 @@ runtests_SOURCES = \
     runtests.c \
     structdata.c
 
-runtests_cxx_SOURCES = \
-    acc_tests_cxx.cpp \
-    alloc_tests_cxx.cpp \
-    basic_tests_cxx.cpp \
-    chardata_cxx.cpp \
-    common_cxx.cpp \
-    dummy_cxx.cpp \
-    handlers_cxx.cpp \
-    memcheck_cxx.cpp \
-    minicheck_cxx.cpp \
-    misc_tests_cxx.cpp \
-    nsalloc_tests_cxx.cpp \
-    ns_tests_cxx.cpp \
-    runtests_cxx.cpp \
-    structdata_cxx.cpp
-
 runtests_LDADD = ../lib/libtestpat.la
-runtests_cxx_LDADD = ../lib/libtestpat.la
 runtests_LDFLAGS = @AM_LDFLAGS@ @LIBM@
-runtests_cxx_LDFLAGS = @AM_LDFLAGS@ @LIBM@
 EXTRA_DIST = \
     acc_tests.h \
     alloc_tests.h \
@@ -737,7 +681,7 @@ EXTRA_DIST = \
 all: all-recursive
 
 .SUFFIXES:
-.SUFFIXES: .c .cpp .lo .log .o .obj .test .test$(EXEEXT) .trs
+.SUFFIXES: .c .lo .log .o .obj .test .test$(EXEEXT) .trs
 $(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
@@ -776,10 +720,6 @@ runtests$(EXEEXT): $(runtests_OBJECTS) $(runtests_DEPENDENCIES) $(EXTRA_runtests
 	@rm -f runtests$(EXEEXT)
 	$(AM_V_CCLD)$(runtests_LINK) $(runtests_OBJECTS) $(runtests_LDADD) $(LIBS)
 
-runtests_cxx$(EXEEXT): $(runtests_cxx_OBJECTS) $(runtests_cxx_DEPENDENCIES) $(EXTRA_runtests_cxx_DEPENDENCIES) 
-	@rm -f runtests_cxx$(EXEEXT)
-	$(AM_V_CXXLD)$(runtests_cxx_LINK) $(runtests_cxx_OBJECTS) $(runtests_cxx_LDADD) $(LIBS)
-
 mostlyclean-compile:
 	-rm -f *.$(OBJEXT)
 
@@ -787,33 +727,19 @@ distclean-compile:
 	-rm -f *.tab.c
 
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/acc_tests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/acc_tests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alloc_tests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alloc_tests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/basic_tests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/basic_tests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/chardata.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/chardata_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/common.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/common_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dummy.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dummy_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/handlers.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/handlers_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/memcheck.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/memcheck_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/minicheck.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/minicheck_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/misc_tests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/misc_tests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ns_tests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ns_tests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/nsalloc_tests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/nsalloc_tests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runtests.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runtests_cxx.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/structdata.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/structdata_cxx.Po@am__quote@ # am--include-marker
 
 $(am__depfiles_remade):
 	@$(MKDIR_P) $(@D)
@@ -842,27 +768,6 @@ am--depfiles: $(am__depfiles_remade)
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
 
-.cpp.o:
-@am__fastdepCXX_TRUE@	$(AM_V_CXX)$(CXXCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCXX_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-@AMDEP_TRUE@@am__fastdepCXX_FALSE@	$(AM_V_CXX)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCXX_FALSE@	DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCXX_FALSE@	$(AM_V_CXX@am__nodep@)$(CXXCOMPILE) -c -o $@ $<
-
-.cpp.obj:
-@am__fastdepCXX_TRUE@	$(AM_V_CXX)$(CXXCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCXX_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-@AMDEP_TRUE@@am__fastdepCXX_FALSE@	$(AM_V_CXX)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCXX_FALSE@	DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCXX_FALSE@	$(AM_V_CXX@am__nodep@)$(CXXCOMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
-
-.cpp.lo:
-@am__fastdepCXX_TRUE@	$(AM_V_CXX)$(LTCXXCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCXX_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
-@AMDEP_TRUE@@am__fastdepCXX_FALSE@	$(AM_V_CXX)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCXX_FALSE@	DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCXX_FALSE@	$(AM_V_CXX@am__nodep@)$(LTCXXCOMPILE) -c -o $@ $<
-
 mostlyclean-libtool:
 	-rm -f *.lo
 
@@ -1141,13 +1046,6 @@ runtests.log: runtests$(EXEEXT)
 	--log-file $$b.log --trs-file $$b.trs \
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
-runtests_cxx.log: runtests_cxx$(EXEEXT)
-	@p='runtests_cxx$(EXEEXT)'; \
-	b='runtests_cxx'; \
-	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
-	--log-file $$b.log --trs-file $$b.trs \
-	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
-	"$$tst" $(AM_TESTS_FD_REDIRECT)
 .test.log:
 	@p='$<'; \
 	$(am__set_b); \
@@ -1268,33 +1166,19 @@ clean-am: clean-checkPROGRAMS clean-generic clean-libtool \
 
 distclean: distclean-recursive
 	-rm -f ./$(DEPDIR)/acc_tests.Po
-	-rm -f ./$(DEPDIR)/acc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/alloc_tests.Po
-	-rm -f ./$(DEPDIR)/alloc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/basic_tests.Po
-	-rm -f ./$(DEPDIR)/basic_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/chardata.Po
-	-rm -f ./$(DEPDIR)/chardata_cxx.Po
 	-rm -f ./$(DEPDIR)/common.Po
-	-rm -f ./$(DEPDIR)/common_cxx.Po
 	-rm -f ./$(DEPDIR)/dummy.Po
-	-rm -f ./$(DEPDIR)/dummy_cxx.Po
 	-rm -f ./$(DEPDIR)/handlers.Po
-	-rm -f ./$(DEPDIR)/handlers_cxx.Po
 	-rm -f ./$(DEPDIR)/memcheck.Po
-	-rm -f ./$(DEPDIR)/memcheck_cxx.Po
 	-rm -f ./$(DEPDIR)/minicheck.Po
-	-rm -f ./$(DEPDIR)/minicheck_cxx.Po
 	-rm -f ./$(DEPDIR)/misc_tests.Po
-	-rm -f ./$(DEPDIR)/misc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/ns_tests.Po
-	-rm -f ./$(DEPDIR)/ns_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/nsalloc_tests.Po
-	-rm -f ./$(DEPDIR)/nsalloc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/runtests.Po
-	-rm -f ./$(DEPDIR)/runtests_cxx.Po
 	-rm -f ./$(DEPDIR)/structdata.Po
-	-rm -f ./$(DEPDIR)/structdata_cxx.Po
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-tags
@@ -1341,33 +1225,19 @@ installcheck-am:
 
 maintainer-clean: maintainer-clean-recursive
 	-rm -f ./$(DEPDIR)/acc_tests.Po
-	-rm -f ./$(DEPDIR)/acc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/alloc_tests.Po
-	-rm -f ./$(DEPDIR)/alloc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/basic_tests.Po
-	-rm -f ./$(DEPDIR)/basic_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/chardata.Po
-	-rm -f ./$(DEPDIR)/chardata_cxx.Po
 	-rm -f ./$(DEPDIR)/common.Po
-	-rm -f ./$(DEPDIR)/common_cxx.Po
 	-rm -f ./$(DEPDIR)/dummy.Po
-	-rm -f ./$(DEPDIR)/dummy_cxx.Po
 	-rm -f ./$(DEPDIR)/handlers.Po
-	-rm -f ./$(DEPDIR)/handlers_cxx.Po
 	-rm -f ./$(DEPDIR)/memcheck.Po
-	-rm -f ./$(DEPDIR)/memcheck_cxx.Po
 	-rm -f ./$(DEPDIR)/minicheck.Po
-	-rm -f ./$(DEPDIR)/minicheck_cxx.Po
 	-rm -f ./$(DEPDIR)/misc_tests.Po
-	-rm -f ./$(DEPDIR)/misc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/ns_tests.Po
-	-rm -f ./$(DEPDIR)/ns_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/nsalloc_tests.Po
-	-rm -f ./$(DEPDIR)/nsalloc_tests_cxx.Po
 	-rm -f ./$(DEPDIR)/runtests.Po
-	-rm -f ./$(DEPDIR)/runtests_cxx.Po
 	-rm -f ./$(DEPDIR)/structdata.Po
-	-rm -f ./$(DEPDIR)/structdata_cxx.Po
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic
 
diff --git a/tests/basic_tests.c b/tests/basic_tests.c
index 02d1d5fd3c10..537c7e0e5a5c 100644
--- a/tests/basic_tests.c
+++ b/tests/basic_tests.c
@@ -20,6 +20,7 @@
    Copyright (c) 2021      Donghee Na <donghee.na@python.org>
    Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
    Copyright (c) 2024-2025 Berkay Eren Ürün <berkay.ueruen@siemens.com>
+   Copyright (c) 2026      Francesco Bertolaccini
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -204,6 +205,30 @@ START_TEST(test_hash_collision) {
 END_TEST
 #undef COLLIDING_HASH_SALT
 
+START_TEST(test_hash_salt_setter) {
+  const uint8_t entropy[16] = {'0', '1', '2', '3', '4', '5', '6', '7',
+                               '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
+  XML_Parser parser = XML_ParserCreate(NULL);
+
+  // NULL parser should be rejected
+  assert_true(XML_SetHashSalt16Bytes(NULL, entropy) == XML_FALSE);
+
+  // NULL entropy should be rejected
+  assert_true(XML_SetHashSalt16Bytes(parser, NULL) == XML_FALSE);
+
+  // Setting should be allowed more than once
+  assert_true(XML_SetHashSalt16Bytes(parser, entropy) == XML_TRUE);
+  assert_true(XML_SetHashSalt16Bytes(parser, entropy) == XML_TRUE);
+
+  // But not after parsing has started
+  assert_true(XML_Parse(parser, "", 0, XML_FALSE /* isFinal */)
+              == XML_STATUS_OK);
+  assert_true(XML_SetHashSalt16Bytes(parser, entropy) == XML_FALSE);
+
+  XML_ParserFree(parser);
+}
+END_TEST
+
 /* Regression test for SF bug #491986. */
 START_TEST(test_danish_latin1) {
   const char *text = "<?xml version='1.0' encoding='iso-8859-1'?>\n"
@@ -6292,6 +6317,7 @@ make_basic_test_case(Suite *s) {
   tcase_add_test(tc_basic, test_bom_utf16_le);
   tcase_add_test(tc_basic, test_nobom_utf16_le);
   tcase_add_test(tc_basic, test_hash_collision);
+  tcase_add_test(tc_basic, test_hash_salt_setter);
   tcase_add_test(tc_basic, test_illegal_utf8);
   tcase_add_test(tc_basic, test_utf8_auto_align);
   tcase_add_test(tc_basic, test_utf16);
diff --git a/tests/common_cxx.cpp b/tests/common_cxx.cpp
deleted file mode 100644
index 698a0ccfa9d5..000000000000
--- a/tests/common_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "common.c"
diff --git a/tests/dummy_cxx.cpp b/tests/dummy_cxx.cpp
deleted file mode 100644
index 27c9f431ecd8..000000000000
--- a/tests/dummy_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "dummy.c"
diff --git a/tests/handlers_cxx.cpp b/tests/handlers_cxx.cpp
deleted file mode 100644
index 86c62b159cc7..000000000000
--- a/tests/handlers_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "handlers.c"
diff --git a/tests/memcheck_cxx.cpp b/tests/memcheck_cxx.cpp
deleted file mode 100644
index e62ac98999c8..000000000000
--- a/tests/memcheck_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "memcheck.c"
diff --git a/tests/minicheck_cxx.cpp b/tests/minicheck_cxx.cpp
deleted file mode 100644
index 58881c60ba07..000000000000
--- a/tests/minicheck_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "minicheck.c"
diff --git a/tests/misc_tests.c b/tests/misc_tests.c
index 1c508bd10466..6d1a2f1488b0 100644
--- a/tests/misc_tests.c
+++ b/tests/misc_tests.c
@@ -212,7 +212,7 @@ START_TEST(test_misc_version) {
   if (! versions_equal(&read_version, &parsed_version))
     fail("Version mismatch");
 
-  if (xcstrcmp(version_text, XCS("expat_2.7.5"))
+  if (xcstrcmp(version_text, XCS("expat_2.8.0"))
       != 0) /* needs bump on releases */
     fail("XML_*_VERSION in expat.h out of sync?\n");
 }
diff --git a/tests/misc_tests_cxx.cpp b/tests/misc_tests_cxx.cpp
deleted file mode 100644
index 0b84c1b1f4d6..000000000000
--- a/tests/misc_tests_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "misc_tests.c"
diff --git a/tests/ns_tests_cxx.cpp b/tests/ns_tests_cxx.cpp
deleted file mode 100644
index b2fe187bb8b4..000000000000
--- a/tests/ns_tests_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "ns_tests.c"
diff --git a/tests/nsalloc_tests.c b/tests/nsalloc_tests.c
index 9e26d4ee1418..830bd1953b73 100644
--- a/tests/nsalloc_tests.c
+++ b/tests/nsalloc_tests.c
@@ -10,7 +10,7 @@
    Copyright (c) 2003      Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2005-2007 Steven Solie <steven@solie.ca>
    Copyright (c) 2005-2012 Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017-2022 Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2017      Joe Orton <jorton@redhat.com>
    Copyright (c) 2017      José Gutiérrez de la Concha <jose@zeroc.com>
@@ -18,6 +18,7 @@
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2020      Tim Gates <tim.gates@iress.com>
    Copyright (c) 2021      Donghee Na <donghee.na@python.org>
+   Copyright (c) 2026      Christian Ng <christianrng@berkeley.edu>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -1507,7 +1508,7 @@ END_TEST
 
 /* Verify that retry after OOM in setContext() does not crash.
  */
-START_TEST(test_nsalloc_setContext_zombie) {
+START_TEST(test_nsalloc_set_context_zombie) {
   const char *text = "<doc>Hello</doc>";
   unsigned int i;
   const unsigned int max_alloc_count = 30;
@@ -1519,7 +1520,9 @@ START_TEST(test_nsalloc_setContext_zombie) {
       break;
     /* Retry on the same parser — must not crash */
     g_allocation_count = ALLOC_ALWAYS_SUCCEED;
-    XML_Parse(g_parser, text, (int)strlen(text), XML_TRUE);
+    const enum XML_Status status
+        = XML_Parse(g_parser, text, (int)strlen(text), XML_TRUE);
+    (void)status;
 
     nsalloc_teardown();
     nsalloc_setup();
@@ -1565,5 +1568,5 @@ make_nsalloc_test_case(Suite *s) {
   tcase_add_test__if_xml_ge(tc_nsalloc, test_nsalloc_long_default_in_ext);
   tcase_add_test(tc_nsalloc, test_nsalloc_long_systemid_in_ext);
   tcase_add_test(tc_nsalloc, test_nsalloc_prefixed_element);
-  tcase_add_test(tc_nsalloc, test_nsalloc_setContext_zombie);
+  tcase_add_test(tc_nsalloc, test_nsalloc_set_context_zombie);
 }
diff --git a/tests/nsalloc_tests_cxx.cpp b/tests/nsalloc_tests_cxx.cpp
deleted file mode 100644
index 9ba75d1c5368..000000000000
--- a/tests/nsalloc_tests_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "nsalloc_tests.c"
diff --git a/tests/structdata_cxx.cpp b/tests/structdata_cxx.cpp
deleted file mode 100644
index 43448f634057..000000000000
--- a/tests/structdata_cxx.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/* C++ compilation harness for the test suite.
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2023 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "structdata.c"
diff --git a/xmlwf/xmlfile.c b/xmlwf/xmlfile.c
index c4eb839f6b3b..62498e60c105 100644
--- a/xmlwf/xmlfile.c
+++ b/xmlwf/xmlfile.c
@@ -11,7 +11,7 @@
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2004-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2005-2007 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2021      Donghee Na <donghee.na@python.org>
diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c
index 2d0c4f8efd19..090063f77482 100644
--- a/xmlwf/xmlwf.c
+++ b/xmlwf/xmlwf.c
@@ -11,7 +11,7 @@
    Copyright (c) 2001-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2004-2009 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2005-2007 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2020      Joe Orton <jorton@redhat.com>