Release Expat 2.4.0

[hartwork]

Regular releases:

• Bump .so version info, document in change log
• Bump release version everywhere (including doc/reference.html)
• Fill release date (both change log and man page date)
• make distcheck source tarballs using ./distribute.sh
• Build Windows installer using AppVeyor CI — https://ci.appveyor.com/project/libexpat/libexpat/builds/39279558/artifacts
• Build Windows binaries zip file from installer a la expat-win32bin-2.3.0.exe showing virus warnings #461 (comment)
• SourceForge:
  • Upload Windows installer and binaries zip file
  • Upload source tarballs + .asc GPG signature (Feature request: GPG-signed release tarballs #193)
  • Make one new source tarball default download for all but Windows
  • Make new binary zip file default download for Windows
• GitHub:
  • Create signed Git tag and push it
  • Create new release — https://github.com/libexpat/libexpat/releases/tag/R_2_4_0
  • Upload source tarball + .asc GPG signature (Feature request: GPG-signed release tarballs #193)
  • Upload Windows installer and binaries zip file
• Let the community know:
  • News item on https://libexpat.github.io/
  • Mail Expat distro maintainers directly
  • Write to the xml-dev mailing list — http://lists.xml.org/archives/xml-dev/202105/msg00011.html
  • Blog about it at blog.hartwork.org — https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/
    • Submit to Hacker News — https://news.ycombinator.com/item?id=27257272
  • Blog about it at xml.com — https://www.xml.com/news/2021-05-expat-240-and-241/
• (Bump ebuild in Gentoo — gentoo/gentoo@da6c3ff)
• (Ask CMake to update their bundled copy (in case of relevant bugfixes) — https://gitlab.kitware.com/cmake/cmake/-/issues/22231)

Specific to 2.4.0:

• Additional communication due to security aspects, e.g.
  • Anaconda — mailed on 2021-05-24 and 2021-06-02
  • Android security — mailed 2021-05-24
  • Apple product security — mailed on 2021-05-24
  • Chromium security — mailed 2021-05-24
  • Conan — [request] expat/2.4.1 (fixes CVE-2013-0340) conan-io/conan-center-index#5610
  • crosstool-ng — [Git master] Please upgrade vulnerable Expat 2.1.1/2.3.0 to 2.4.1 (CVE-2013-0340) crosstool-ng/crosstool-ng#1520
  • CryEngine — https://github.com/CRYTEK/CRYENGINE/issues/812
  • Entware — Please update Expat from 2.2.10 to 2.4.1 with security fixes Entware/Entware#662
  • Fink — Please update vulnerable Expat 2.3.0 to 2.4.1 fink/fink-distributions#831
  • Gentoo — https://bugs.gentoo.org/791703
  • GoboLinux — Please bump vulnerable Expat to 2.4.1 gobolinux/Recipes#135
  • harfbuzz — Pinning vulnerable Expat 2.2.9 at ./harfbuzz/subprojects/expat.wrap harfbuzz/harfbuzz#2987
  • hexpat — Please update bundled vulnerable Expat 2.2.1 to latest release >=2.4.3 the-real-blackh/hexpat#11
  • LibreOffice security — mailed 2021-05-24
  • Lunar Linux — Please bump vulnerable Expat to 2.4.1 lunar-linux/moonbase-core#2817
  • Mozilla security — mailed 2021-05-24
  • nixos — expat: 2.2.10 -> 2.4.1 (CVE-2013-0340) NixOS/nixpkgs#124212
  • OpenOffice security — mailed 2021-05-24
  • Pisi Linux — Please update vulnerable Expat to 2.4.1 pisilinux/core#1209
  • Poco — already has Update bundled expat to 2.4.0 pocoproject/poco#3279
  • Python security — mailed 2021-05-24, issue https://bugs.python.org/issue44394
  • rexpat — Re-transpile from Expat >=2.4.0 to gain protection against Billion Laughs Attacks (CVE-2013-0340)? immunant/rexpat#62
  • Rudix — Please update Expat from 2.2.9 to 2.4.1 with security fixes rudix-mac/rudix#116
  • Spack — Please upgrade vulnerable Expat to version >=2.4.0 (CVE-2013-0340) spack/spack#24628
  • Smart — [security] Please upgrade vulnerable Expat at smart/util/celementtree/expat/ smartpm/smart#17
  • WinSCP — mailed 2021-05-24
  • xmp-toolkit-rs — Old vulnerable copy of Expat 2.1.0 bundled at ./external/expat/? adobe/xmp-toolkit-rs#18