Bundles vulnerable copy of Expat - please update to 2.2.5

[akoeplinger]

Issue moved from mono/linux-packaging-skiasharp#1.

@hartwork commented:

This repository bundles an outdated vulnerable copy of Expat 2.1.0. Please update your copy to version 2.2.1 with the latest security fixes. A change log with details is available at https://github.com/libexpat/libexpat/blob/master/expat/Changes . Thank you!

VS bug #738684

[mattleibow]

According to this post, wee should be selecting our own versions of he dependencies: https://groups.google.com/forum/#!topic/skia-discuss/RIPQqRjcVEE

We probably need to go through the list in https://github.com/mono/skia/blob/xamarin-mobile-bindings/DEPS and make sure we are up to date.

[spsteve10]

@mattleibow Can we expect a release with an updated version of expat (ie:2.2.5)? What is the status? Thanks

[hartwork]

(Just for completeness: There is libexpat 2.2.6 by now.)

[mattleibow]

I will see if I can get the update with the latest version of the dependencies.

[AshishMantosh]

Any updates on this?

[hartwork]

For the record, there is 2.2.9 by now with more security fixes in 2.2.8.

[AshishMantosh]

Thanks for the response with the PR @mattleibow Hoping for a quick review.

[mattleibow]

Merged and will be in the next 1.68.2 preview

[hartwork]

Thank you!