Release Expat 2.6.0

[hartwork]

Regular releases:

• Bump .so version info, document in change log — https://verbump.de/
• Bump release version everywhere (including doc/reference.html)
• Fill release date (both change log and man page date)
• make distcheck source tarballs using ./distribute.sh
• Build Windows installer using AppVeyor CI — https://ci.appveyor.com/project/libexpat/libexpat/builds/49123612/artifacts
• Build Windows binaries zip file from installer
• SourceForge:
  • Upload Windows installer and binaries zip file
  • Upload source tarballs + .asc GPG signature files
  • Make one new source tarball default download for all but Windows
  • Make new binary zip file default download for Windows
• GitHub:
  • Create signed Git tag and push it
  • Create new release — https://github.com/libexpat/libexpat/releases/tag/R_2_6_0
  • Upload source tarballs + .asc GPG signature files
  • Upload Windows installer and binaries zip file
  • Close current milestone and create a follow-up one
• Website
  • Add news item — libexpat/libexpat.github.io@c4db09b
  • Sync API documentation — libexpat/libexpat.github.io@100f69b
• Let the community know:
  • Mail Expat distro maintainers directly
  • Write to the xml-dev mailing list — http://lists.xml.org/archives/xml-dev/202402/msg00001.html
  • Blog about it at blog.hartwork.org — https://blog.hartwork.org/posts/expat-2-6-0-released/
    • Submit to Hacker News — https://news.ycombinator.com/item?id=39279338
    • Submit to Lobsters — https://lobste.rs/s/2epqsl/expat_2_6_0_released_includes_security
  • Blog about it at xml.com — https://www.xml.com/news/2024-02-expat-260/
• Bump ebuild in Gentoo — gentoo/gentoo@e4b19b2

Specific to 2.6.0:

• security aspects

Related downstream issues and pull requests:

• conda-forge — expat v2.6.1 conda-forge/expat-feedstock#43
• CPython
  • test.test_xml_etree*.XMLPullParserTest.test_simple_xml fails with (system) expat 2.6.0 python/cpython#115133
  • Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled python/cpython#115398
  • Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425) python/cpython#115399
  • gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 python/cpython#115164
  • gh-115399: Upgrade bundled libexpat to 2.6.0 python/cpython#115431
  • gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" python/cpython#115400
• Fink — Please bump vulnerable Expat to 2.6.0 fink/fink-distributions#1127
• Gentoo — gentoo/gentoo@e4b19b2
• Gobo Linux — Please bump vulnerable Expat to 2.6.0 gobolinux/Recipes#204
• OsmAnd — Use of Expat <2.6.0 with `XML_DTD` un(!)defined is vulnerable to CVE-2023-52426 (denial of service) osmandapp/OsmAnd#19040
• Spack — expat: Add latest release 2.6.0 with security fixes spack/spack#42680