textproc/libxml2, textproc/libxslt: vulnerable

Note that libxslt is vulnerable, unfixed, and without maintainer.
Two of four vulnerabilities have been fixed.

Note that libxml2 in our ports is vulnerable and there is no upstream
release fixing these bugs, they need cherry-picks.

Deprecate textproc/xmlto and textproc/minixmlto,
which both depend on the unmaintained and vulnerable libxslt.
I have filed https://pagure.io/xmlto/issue/15 to ask the xmlto
upstream to switch to different XML/XSLT libraries.

Two issues are undisclosed and do not seem to have a CVE assigned yet.

Security:	CVE-2025-6021
Security:	CVE-2025-6170
Security:	CVE-2025-7424
Security:	CVE-2025-7425
Security:	CVE-2025-49794
Security:	CVE-2025-49795
Security:	CVE-2025-49795
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/913
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/926
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/931
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/932
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/933
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/935
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/941
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/148
Security:	https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt
Security:	https://www.openwall.com/lists/oss-security/2025/06/16/6

3 files changed, 23 insertions, 12 deletions

diff --git a/textproc/libxslt/Makefile b/textproc/libxslt/Makefile
index dcfd2041aefc..344606952e8f 100644
--- a/textproc/libxslt/Makefile
+++ b/textproc/libxslt/Makefile
@@ -12,6 +12,9 @@ WWW=		https://gitlab.gnome.org/GNOME/libxslt/
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/Copyright
 
+DEPRECATED=	unmaintained with multiple unfixed security vulnerabilities
+EXPIRATION_DATE=2025-09-12
+
 # See note in textproc/libxml2 for why this port uses autotools
 USES=		cpe gmake gnome libtool localbase:ldflags pathfix pkgconfig tar:xz
 CPE_VENDOR=	xmlsoft
diff --git a/textproc/minixmlto/Makefile b/textproc/minixmlto/Makefile
index 0f7b3a058b33..351240e79858 100644
--- a/textproc/minixmlto/Makefile
+++ b/textproc/minixmlto/Makefile
@@ -9,6 +9,9 @@ WWW=		https://github.com/bapt/minixmlto
 
 LICENSE=	BSD2CLAUSE
 
+DEPRECATED=     Depends on vulnerable unmaintained libxslt
+EXPIRATION_DATE=2025-09-12
+
 RUN_DEPENDS=	docbook-xsl>0:textproc/docbook-xsl \
 		xsltproc:textproc/libxslt \
 		html2text:textproc/html2text \
diff --git a/textproc/xmlto/Makefile b/textproc/xmlto/Makefile
index cd2e6c55d175..278d599474d7 100644
--- a/textproc/xmlto/Makefile
+++ b/textproc/xmlto/Makefile
@@ -17,6 +17,9 @@ WWW=		https://pagure.io/xmlto/
 
 LICENSE=	GPLv2
 
+DEPRECATED=	Depends on vulnerable unmaintained libxslt
+EXPIRATION_DATE=2025-09-12
+
 BUILD_DEPENDS=	${BASH_CMD}:shells/bash \
 		${GETOPT_CMD}:misc/getopt \
 		xmllint:textproc/libxml2 \
@@ -27,8 +30,19 @@ BUILD_DEPENDS=	${BASH_CMD}:shells/bash \
 		docbook-xml>0:textproc/docbook-xml
 RUN_DEPENDS:=	${BUILD_DEPENDS}
 
+USES=		tar:bzip2
+GNU_CONFIGURE=	yes
+GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
+CONFIGURE_ARGS=	BASH=${BASH_CMD} GETOPT=${GETOPT_CMD} PDFXMLTEX=${PDFXMLTEX_CMD}
+MAKE_ENV+=	HOME=/dev/null
+
 SUB_FILES=	pkg-message
 
+PORTDOCS=	AUTHORS ChangeLog NEWS THANKS
+# these documentation files do not convey information useful for
+# the FreeBSD port at this time, or are provided by the ports framework:
+# PORTDOCS+=	COPYING FAQ README
+
 OPTIONS_DEFINE=	DOCS
 OPTIONS_GROUP=		BACKEND
 OPTIONS_GROUP_BACKEND=		DBLATEX FOP PASSIVETEX
@@ -37,21 +51,12 @@ DBLATEX_DESC=		Add dependency on DBlatex (DB for DocBook)
 FOP_DESC=		Add dependency on FOP (requires Java)
 PASSIVETEX_DESC=	Add dependency on XMLTeX/PassiveTeX
 
-USES=		tar:bzip2
-GNU_CONFIGURE=	yes
-GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
-CONFIGURE_ARGS=	BASH=${BASH_CMD} GETOPT=${GETOPT_CMD} PDFXMLTEX=${PDFXMLTEX_CMD}
-MAKE_ENV+=	HOME=/dev/null
-
 BASH_CMD=	${LOCALBASE}/bin/bash
 GETOPT_CMD=	${LOCALBASE}/bin/getopt
-XSL_DIR=	${LOCALBASE}/share/xsl/docbook
 PDFXMLTEX_CMD=	${LOCALBASE}/bin/pdftex
-
-PORTDOCS=	AUTHORS ChangeLog NEWS THANKS
-# these documentation files do not convey information useful for
-# the FreeBSD port at this time, or are provided by the ports framework:
-# PORTDOCS+=	COPYING FAQ README
+.ifnmake portclippy
+XSL_DIR=	${LOCALBASE}/share/xsl/docbook
+.endif
 
 .include <bsd.port.pre.mk>