expat-devel vulnerabilities