From eb7e6a6aa5fc4d6eb7af7a919c507a84ddabce6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Henrik=20O=2E=20S=C3=B8rensen?= <henrik.sorensen@gmail.com>
Date: Wed, 5 Aug 2026 13:38:38 +0200
Subject: [PATCH] build: Update liblouis to 3.38.0

Five releases on from 3.33.0, which was March 2025. Notable for this
wrapper are memory safety fixes in code paths it P/Invokes directly: a
heap buffer overflow in back_passDoAction, a segfault in
lou_compileString, and missing length validation in _lou_backTranslate.

The version and its checksum are the only functional change; everything
else derives from them. The two remaining 3.33 references were examples
in comments and documentation.

Verified rather than assumed:

- All eight RIDs build. win-arm64 still needs the -Wl,--add-stdcall-alias
  workaround, so that upstream assumption survives, as expected.
- The glibc floor is unchanged: 2.34, 2.33, 2.33 for linux-x86, x64 and
  arm64. That decides which distributions can consume the packages, and
  new upstream code is exactly what could raise it.
- Every binary exports all eighteen P/Invoke entry points and depends on
  nothing outside its platform allowlist. 3.38 exports 34 lou_ functions
  where 3.33 exported 30.
- The tests pass, so the tables still compile. 3.38 rejects uppercase
  virtual dots, which is its one backwards incompatible change, and none
  of Nota's tables use them.

475 tables now stage, up from 444.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Directory.Build.props | 6 +++---
 PACKAGING.md          | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index 67ab6d2..22982bc 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -7,14 +7,14 @@
     each property on one line in the form <Name>value</Name>.
   -->
   <PropertyGroup>
-    <LiblouisVersion>3.33.0</LiblouisVersion>
-    <LiblouisTarballSha384>2906b0787781c195b4386ee52090d1038990db4134705ad207b2820e790d33d9384ddea1818e32762b8c1f4f9e380a77</LiblouisTarballSha384>
+    <LiblouisVersion>3.38.0</LiblouisVersion>
+    <LiblouisTarballSha384>c4ed69af87344e34cb88b9775cc4423e18a7891443ac73c0a173ecbbb558513f2a3a58df9d99b39335319034f5b320b4</LiblouisTarballSha384>
   </PropertyGroup>
 
   <!--
     Version stamped on the native runtime packages. It tracks the upstream liblouis version so a
     consumer can tell at a glance which liblouis they are getting. Override it when a packaging-only
-    fix has to ship without an upstream bump, e.g. -p:LiblouisPackageVersion=3.33.0.1
+    fix has to ship without an upstream bump, e.g. -p:LiblouisPackageVersion=3.38.0.1
   -->
   <PropertyGroup>
     <LiblouisPackageVersion Condition="'$(LiblouisPackageVersion)' == ''">$(LiblouisVersion)</LiblouisPackageVersion>
diff --git a/PACKAGING.md b/PACKAGING.md
index a1ae783..b15213f 100644
--- a/PACKAGING.md
+++ b/PACKAGING.md
@@ -35,7 +35,7 @@ When a project references such a package, the .NET SDK records every one of thes
 application's `.deps.json` under `runtimeTargets`, tagged with its RID:
 
 ```json
-"runtime.win-x64.liblouis/3.33.0": {
+"runtime.win-x64.liblouis/3.38.0": {
   "runtimeTargets": {
     "runtimes/win-x64/native/liblouis.dll": { "rid": "win-x64", "assetType": "native" }
   }