Update expat

[Hixie]

It appears we have literally never updated expat in the history of our project: https://flutter.googlesource.com/third_party/expat/+/refs/heads/master/files/Changes

We really should update expat if we're going to use it.

cc @zanderso

[zanderso]

It looks like this is only used by Skia? Can we just mimic what Skia does instead of putting this under flutter.googlesource.com? https://github.com/google/skia/blame/main/DEPS#L26. Looks like Skia has it's own BUILD.gn file anyway, so maybe this is just pulling the bits from a different place. @cbracken @jason-simmons for advice.

[elson-dsouza]

Hello do we have an update on this. Our security scans keep flagging this lib due to vulnerabilities in the version of expat being used here

[Hixie]

@elson-dsouza the good news is it's only used for parsing the font file on Android so there's not actually a vulnerability here, which is why we haven't been jumping on this as fast as we would otherwise. But let me see if I can raise the priority.

[zanderso]

Thanks, @jason-simmons !

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.