[Several vulnerabilities were fixed](http://seclists.org/oss-sec/2017/q2/499) in the just released expat 2.2.1. The bundled version of expat needs to be updated.