It appears we have literally never updated expat in the history of our project: https://flutter.googlesource.com/third_party/expat/+/refs/heads/master/files/Changes

We really should update expat if we're going to use it.

cc @zanderso