Upgrade the bundled libexpat version to 2.5.0 which includes a fix forCVE-2022-43680. I haven't evaluated whether CPython is directly impacted by this CVE, but can confirm that it is detected by binary analysis tools such as Black Duck.

Relatedlibexpat changelog includes additional fixes and details.