Old vulnerable copy of Expat 2.1.0 bundled at ./external/expat/?

[hartwork]

Expected Behaviour

Use of a version of Expat with all known vulnerabilities fixed, i.e. >=2.4.0, ideally 2.4.1

Actual Behaviour

Use of known vulnerable Expat 2.1.0

[hartwork]

Any thoughts?

[scouten]

@hartwork thanks for checking in on this again. I'm consulting with the team that builds the underlying C++ XMP Toolkit at Adobe to see if there are any potential compatibility issues and to see if we can share effort on vetting the upgrade. No news to share at the moment, but I'll speak up as soon as I know something.

[scouten]

@hartwork could you look at the build log for #19 and advise on the "high quality entropy" error? I'm not sufficiently familiar with the innards of expat to know what to adjust. I've fixed this issue.

[scouten]

@hartwork please see libexpat/libexpat#497. That is blocking my ability to update.

[hartwork]

@scouten great to see this fixed, thanks for your work on this topic! 🎉 🙏

[scouten]

@hartwork no worries. Thank you for bringing it to my attention and staying with me on this. New versioned release coming momentarily.

[scouten]

The new version of expat is included in version 0.1.8, which is now published to crates.io.