depends, libevent: update to 2.1.13-stable

[xanimo]

We ship libevent 2.1.12-stable (2020-07-05). 2.1.13-stable was released 2026-07-01 carrying seven security advisories, and libdogecoin exercises all three affected subsystems.

Module	Used in	Advisory
bufferevent/evbuffer	net.c, rest.c	GHSA-c2pj-cg4r-88c8 — dangling pointer in evbuffer_add_reference
evhttp	net.c, rest.c, cli/spvnode.c	GHSA-2gmv-p5m7-98p6 (trailer smuggling), GHSA-q39v-w2g7-gr8j (request smuggling), GHSA-jcwh-pvf2-73p2 (CRLF/NUL parser mismatch), GHSA-cvq5-vrvr-j338 (AF_UNIX heap OOB write, -DNDEBUG only)
evdns	net.c (DNS seeds)	GHSA-58rx-7448-jw47 — OOB write in dnsname_to_labels

Two more are fixed upstream in evtag/evrpc (GHSA-fj29-64w6-73h6, GHSA-45c6-qx49-89m8) which we don't use.

Unlike everything else in the current audit, this is known-vulnerable code we ship, not a hypothesis.

Both vendoring paths had to move together

• depends/packages/libevent.mk — feeds autotools and gitian via AC_CHECK_LIB
• src/libevent — the vendored copy CMake configures and builds in-tree

Bumping one would leave whichever half a given build used still on 2.1.12. (This is the same split #388's parity gate surfaced.)

Local delta preserved

The vendored tree was libevent's git checkout, not the release tarball, and carried exactly one local change:

-cmake_minimum_required(VERSION 3.1 FATAL_ERROR)
+cmake_minimum_required(VERSION 3.5 FATAL_ERROR)

2.1.13 still declares 3.1, so it's re-applied. I verified that's the only delta by diffing the old vendored tree against a pristine 2.1.12 checkout — they agreed everywhere else.

Nine files removed, not replaced

build-aux/{compile,config.guess,config.sub,depcomp,install-sh,ltmain.sh,missing,test-driver} is autoreconf output, and cmake/BuildType.cmake is an orphan present in neither the 2.1.12 tarball nor the 2.1.13 tree.

Nothing here runs autotools against the vendored copy — CMakeLists.txt drives it with cmake .. / cmake --build — and BuildType.cmake is referenced by no CMakeLists on either side. Both are dead weight, which is why the diff shows 17k deletions against 451 insertions: 28 files are the real 2.1.12→2.1.13 source delta, 0 files added.

Verification

• The depends hash was computed from a fresh download, not copied. As a control, 2.1.12 hashes to the 92e6de1b… value already pinned — which validates the method. 2.1.13 hashes to f7e9383b8c0baa81b687e5b5eecc01beefaf1b19b64151d95ed61647fe7a315c.
• Please confirm that against the upstream GPG signature before merging. A hash I computed from a download I made is only as good as that download, and this is a supply-chain change.
• 0001-fix-windows-getaddrinfo.patch still applies (offset 42 lines) and is still needed — the fix hasn't landed upstream.
• Builds and links against the new tree with WITH_NET=ON. 81/81.

---

Found while auditing dependency currency: there's no submodule and no pin-checking, so nothing would ever have surfaced this. Worth considering a periodic check as a follow-up — this sat four releases behind for six years.