Hi,

I understand this CVE is bigger than I thought CVE patch can be.
Maybe we can think about updating expat beyond the fixed version?
I now it's not the best because it is stable branch but I can't think about correct solution.

Best regards,
Jakub Szczudlo