Merge branch 'dbus-1.10'

diff --cc NEWS
index eae777ad9966a34deabefc79dd7cd3c02ba2097b,37fcd4213793b4b9d1a7127a56000a5898037270..399d379baab2aac388f7085b91f1eca41f9679f2
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,29 -1,21 +1,38 @@@
 -D-Bus 1.10.24 (UNRELEASED)
 +D-Bus 1.11.18 (UNRELEASED)
  ==
  
- ...
+ Fixes:
+ 
+ • When parsing dbus-daemon configuration, tell Expat not to use
+   cryptographic-quality entropy as a salt for its hash tables: we trust
+   the configuration files, so we are not concerned about algorithmic
+   complexity attacks via hash table collisions. This prevents
+   dbus-daemon --system from holding up the boot process (and causing
+   early-boot system services like systemd, logind, networkd to time
+   out) on entropy-starved embedded systems.
+   (fd.o #101858, Simon McVittie)
  
 -D-Bus 1.10.22 (2017-07-27)
 +D-Bus 1.11.16 (2017-07-27)
  ==
  
 -The “roof terrace” release.
 +The “south facing garden” release.
 +
 +Build-time configuration changes:
 +
 +• The Autotools build system now supports varying ${runstatedir}
 +  independently of ${localstatedir}, if using an Autoconf version
 +  that has that feature; version 2.70 will eventually have this, but
 +  many Linux distributions add it to version 2.69 as a patch.
 +  A typical use is to set prefix=/usr, sysconfdir=/etc, localstatedir=/var
 +  and runstatedir=/run. (fd.o #101569, Simon McVittie)
 +
 +Enhancements:
 +
 +• New APIs DBUS_MESSAGE_ITER_INIT_CLOSED, dbus_message_iter_init_closed()
 +  and dbus_message_iter_abandon_container_if_open() simplify the
 +  single-exit-point ("goto out") style of resource cleanup. The API
 +  documentation around DBusMessageIter and containers has also been
 +  clarified. (fd.o #101568, Simon McVittie)
  
  Fixes: