Merge "Upgrade expat to R_2_4_9"
diff --git a/.github/workflows/autotools-cmake.yml b/.github/workflows/autotools-cmake.yml
index b99ae8d..f6fcc87 100644
--- a/.github/workflows/autotools-cmake.yml
+++ b/.github/workflows/autotools-cmake.yml
@@ -41,7 +41,7 @@
     strategy:
       matrix:
         include:
-          - os: macos-10.15
+          - os: macos-11
             configure_args:
             cmake_args:
           - os: ubuntu-20.04
@@ -55,7 +55,7 @@
         shell: bash
     runs-on: "${{ matrix.os }}"
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
 
     - name: (Linux) Install build dependencies
       if: "${{ runner.os == 'Linux' }}"
@@ -119,18 +119,6 @@
         set -x
         cd expat/expat-*.*.*/
 
-        if [[ "${{ matrix.configure_args }}" == *mingw* ]]; then
-          # There is one known difference between Autotools and CMake for MinGW:
-          #   Autotools: usr/local/bin/libexpat-<major>.dll
-          #   CMake:     usr/local/bin/libexpat.dll
-          # We patch the Autotools side in line here to get the differ below to empty.
-          mv build_autotools/ROOT/usr/local/bin/libexpat{-*,}.dll
-          ( cd build_autotools/ROOT/usr/local/lib*/cmake/expat-*/ \
-              && sed 's,libexpat-[0-9]\+\.dll,libexpat.dll,g' expat-noconfig.cmake > expat-noconfig-patched.cmake \
-              && ! diff -u0 expat-noconfig{,-patched}.cmake \
-              && mv expat-noconfig{-patched,}.cmake )
-        fi
-
         if [[ "${{ runner.os }}" == macOS ]]; then
           # Autotools' LT_LIB_M has a hardcoded exclude for "*-*-darwin*" hosts,
           # while macOS does have libm and is successfully found by CMake.
@@ -145,7 +133,7 @@
             --exclude=xmlwf \
             --exclude=xmlwf.exe \
             --exclude=libexpat.a \
-            --exclude=libexpat.dll \
+            --exclude=libexpat-*.dll \
             --exclude=libexpat.dll.a \
             --exclude=libexpat.la \
             --exclude=libexpat.so\* \
diff --git a/.github/workflows/cmake-required-version.yml b/.github/workflows/cmake-required-version.yml
index 2cebd96..303611c 100644
--- a/.github/workflows/cmake-required-version.yml
+++ b/.github/workflows/cmake-required-version.yml
@@ -40,7 +40,7 @@
     name: Ensure realistic minimum CMake version requirement
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
 
     - name: Install ancient CMake
       run: |
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 1826ab2..03eefe9 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -38,26 +38,18 @@
 jobs:
   checks:
     name: Collect test coverage
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@v3.0.0
-    - name: Add Clang/LLVM repositories
-      run: |-
-        set -x
-        source /etc/os-release
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb http://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-14 main"
+    - uses: actions/checkout@v3.0.2
     - name: Install build dependencies
-      # NOTE: Please note the version-specific ${PATH} extension for Clang in .travis.sh
       run: |-
-        sudo dpkg --add-architecture i386  # for wine32
+        set -x -u -o pipefail
+        source /etc/os-release
+
         sudo apt-get update
         sudo apt-get install --yes --no-install-recommends -V \
-            clang-14 \
-            clang-format-14 \
-            llvm-14 \
             cmake \
             docbook2x \
             dos2unix \
@@ -66,10 +58,27 @@
             lcov \
             libbsd-dev \
             lzip \
+            moreutils
+
+        # Get rid of packages installed from ppa:ondrej/php so that we will be able to install wine32:i386 without conflicts
+        # (see issue https://github.com/actions/virtual-environments/issues/4589)
+        # In detail we:
+        #   1. Remove all packages that ppa:ondrej/php has but plain Ubuntu doesn't, e.g. everything PHP
+        #   2. Revert (remaining) packages that ppa:ondrej/php and plain Ubuntu share, back to the plain Ubuntu version
+        #   3. Assert that no packages from ppa:ondrej/php are left installed
+        dpkg -l | grep '^ii' | grep -F deb.sury.org | awk '{print $2}' | grep '^php' \
+          | xargs -r -t sudo apt-get remove --yes libpcre2-posix3 libzip4
+        dpkg -l | grep '^ii' | grep -F deb.sury.org | awk '{print $2}' | sed "s,\$,/${UBUNTU_CODENAME}," \
+          | xargs -r -t sudo apt-get install --yes --no-install-recommends --allow-downgrades -V
+        ! dpkg -l | grep '^ii' | grep -F deb.sury.org
+
+        # Install 32bit Wine
+        sudo dpkg --add-architecture i386  # for wine32
+        sudo apt-get update  # due to new architecture
+        sudo apt-get install --yes --no-install-recommends -V \
             mingw-w64 \
-            moreutils \
             wine-stable \
-            wine32
+            wine32:i386
     - name: Unshallow Git clone
       run: |
         git fetch --force --tags --unshallow origin  # for "git describe" in coverage.sh
@@ -81,7 +90,7 @@
         exec ./.travis.sh
 
     - name: Store coverage .info and HTML report
-      uses: actions/upload-artifact@v3.0.0
+      uses: actions/upload-artifact@v3.1.0
       with:
         name: coverage
         path: expat/coverage__*/
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index 2a0b775..ad1e1c3 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -38,9 +38,9 @@
 jobs:
   checks:
     name: Run Cppcheck
-    runs-on: macos-latest
+    runs-on: macos-11
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
     - name: Install runtime dependencies
       run: |
         exec brew install cppcheck findutils
diff --git a/.github/workflows/expat_config_h.yml b/.github/workflows/expat_config_h.yml
index 1c87f38..ddc7536 100644
--- a/.github/workflows/expat_config_h.yml
+++ b/.github/workflows/expat_config_h.yml
@@ -38,9 +38,9 @@
 jobs:
   checks:
     name: Check expat_config.h.{in,cmake} for regressions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
     - name: Check expat_config.h.{in,cmake} for regressions
       run: |
         set -v
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 3c345a6..68d2c06 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -76,26 +76,52 @@
             FLAT_ENV: CC=i686-w64-mingw32-gcc CXX=i686-w64-mingw32-g++ LD=i686-w64-mingw32-ld QA_PROCESSOR=gcov CMAKE_ARGS="-DCMAKE_SYSTEM_NAME=Windows -DWIN32=ON -DMINGW=ON -DEXPAT_ATTR_INFO=ON"
           - MODE: qa-sh
             FLAT_ENV: CC=i686-w64-mingw32-gcc CXX=i686-w64-mingw32-g++ LD=i686-w64-mingw32-ld QA_PROCESSOR=gcov CMAKE_ARGS="-DCMAKE_SYSTEM_NAME=Windows -DWIN32=ON -DMINGW=ON -DEXPAT_ATTR_INFO=ON -DEXPAT_CHAR_TYPE=wchar_t"
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@v3.0.0
-    - name: Add Clang/LLVM repositories
+    - uses: actions/checkout@v3.0.2
+    - name: Install build dependencies (MinGW)
+      if: "${{ contains(matrix.FLAT_ENV, 'mingw') }}"
+      run: |-
+        set -x -u -o pipefail
+        source /etc/os-release
+
+        # Get rid of packages installed from ppa:ondrej/php so that we will be able to install wine32:i386 without conflicts
+        # (see issue https://github.com/actions/virtual-environments/issues/4589)
+        # In detail we:
+        #   1. Remove all packages that ppa:ondrej/php has but plain Ubuntu doesn't, e.g. everything PHP
+        #   2. Revert (remaining) packages that ppa:ondrej/php and plain Ubuntu share, back to the plain Ubuntu version
+        #   3. Assert that no packages from ppa:ondrej/php are left installed
+        dpkg -l | grep '^ii' | grep -F deb.sury.org | awk '{print $2}' | grep '^php' \
+          | xargs -r -t sudo apt-get remove --yes libpcre2-posix3 libzip4
+        dpkg -l | grep '^ii' | grep -F deb.sury.org | awk '{print $2}' | sed "s,\$,/${UBUNTU_CODENAME}," \
+          | xargs -r -t sudo apt-get install --yes --no-install-recommends --allow-downgrades -V
+        ! dpkg -l | grep '^ii' | grep -F deb.sury.org
+
+        # Install 32bit Wine
+        sudo dpkg --add-architecture i386  # for wine32
+        sudo apt-get update  # due to new architecture
+        sudo apt-get install --yes --no-install-recommends -V \
+            mingw-w64 \
+            wine-stable \
+            wine32:i386
+    - name: Install build dependencies (Non-MinGW)
+      if: "${{ ! contains(matrix.FLAT_ENV, 'mingw') }}"
       run: |-
         set -x
         source /etc/os-release
         wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb http://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-14 main"
-    - name: Install build dependencies
-      # NOTE: Please note the version-specific ${PATH} extension for Clang in .travis.sh
-      run: |-
-        sudo dpkg --add-architecture i386  # for wine32
-        sudo apt-get update
+        sudo add-apt-repository "deb http://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-15 main"
+        sudo apt-get update  # due to new repository
+        # NOTE: Please note the version-specific ${PATH} extension for Clang in .travis.sh
         sudo apt-get install --yes --no-install-recommends -V \
-            clang-14 \
-            clang-format-14 \
-            llvm-14 \
+            clang-15 \
+            clang-format-15 \
+            llvm-15
+    - name: Install build dependencies (common)
+      run: |-
+        sudo apt-get install --yes --no-install-recommends -V \
             cmake \
             docbook2x \
             dos2unix \
@@ -104,10 +130,7 @@
             lcov \
             libbsd-dev \
             lzip \
-            mingw-w64 \
-            moreutils \
-            wine-stable \
-            wine32
+            moreutils
     - name: Perform check "${{ matrix.MODE }}"
       env:
         MODE: ${{ matrix.MODE }}
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 1023e51..69e7002 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -48,9 +48,9 @@
           - MODE: distcheck
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address
-    runs-on: macos-latest
+    runs-on: macos-11
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
     - name: Install build dependencies
       run: |
         sudo rm /usr/local/bin/2to3  # so that "brew link" will work
diff --git a/.github/workflows/scripts/list-shared-library-symbols.sh b/.github/workflows/scripts/list-shared-library-symbols.sh
index 88df478..eeef949 100755
--- a/.github/workflows/scripts/list-shared-library-symbols.sh
+++ b/.github/workflows/scripts/list-shared-library-symbols.sh
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -33,4 +33,4 @@
     echo "usage: $(basename "$0") SO_FILE_PATH" >&2
     exit 1
 fi
-nm -D -p "${1}" | fgrep ' T ' | awk '{print $3}' | sort -f -d
+nm -D -p "${1}" | grep -F ' T ' | awk '{print $3}' | sort -f -d
diff --git a/.github/workflows/valid-xml.yml b/.github/workflows/valid-xml.yml
index 09308ee..2d5c2fe 100644
--- a/.github/workflows/valid-xml.yml
+++ b/.github/workflows/valid-xml.yml
@@ -40,7 +40,7 @@
     name: Ensure well-formed and valid XML
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
 
     - name: Install build dependencies
       run: |-
diff --git a/.mailmap b/.mailmap
index 3a11225..4475f60 100644
--- a/.mailmap
+++ b/.mailmap
@@ -7,6 +7,7 @@
 Karl Waclawek <karl@waclawek.net> <karl.waclawek@qlinesolutions.com>
 Karl Waclawek <karl@waclawek.net> <kwaclaw@users.sourceforge.net>
 Kishore Kunche <kishore.kunche@intel.com>
+Martin Ettl <ettl.martin78@googlemail.com> <orbitcowboy@web.de>
 Rhodri James <rhodri@wildebeest.org.uk> <rhodri@kynesim.co.uk>
 Rolf Eike Beer <eike@sf-mail.de> <eb@emlix.com>
 Sebastian Pipping <sebastian@pipping.org> <hartwork@users.sourceforge.net>
diff --git a/.travis.sh b/.travis.sh
index 79430ed..bb69e80 100755
--- a/.travis.sh
+++ b/.travis.sh
@@ -39,7 +39,7 @@
     export PATH="/usr/local/opt/coreutils/libexec/gnubin${PATH:+:}${PATH}"
     export PATH="/usr/local/opt/findutils/libexec/gnubin${PATH:+:}${PATH}"
 elif [[ ${TRAVIS_OS_NAME} = linux ]]; then
-    export PATH="/usr/lib/llvm-14/bin:${PATH}"
+    export PATH="/usr/lib/llvm-15/bin:${PATH}"
 fi
 
 echo "New \${PATH}:"
diff --git a/COPYING b/COPYING
index 3c0142e..ce9e593 100644
--- a/COPYING
+++ b/COPYING
@@ -1,5 +1,5 @@
 Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper
-Copyright (c) 2001-2019 Expat maintainers
+Copyright (c) 2001-2022 Expat maintainers
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
diff --git a/METADATA b/METADATA
index e5a60b1..73b5a55 100644
--- a/METADATA
+++ b/METADATA
@@ -12,7 +12,7 @@
     type: GIT
     value: "https://github.com/libexpat/libexpat/"
   }
-  version: "R_2_4_8"
+  version: "R_2_4_9"
   license_type: BY_EXCEPTION_ONLY
   license_note: "contains GFDL documentation"
   security {
@@ -20,7 +20,7 @@
   }
   last_upgrade_date {
     year: 2022
-    month: 5
-    day: 23
+    month: 9
+    day: 30
   }
 }
diff --git a/appveyor.yml b/appveyor.yml
index cf0a543..22d6fdc 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@
 #                               |_| XML parser
 #
 # Copyright (c) 2017      José Gutiérrez de la Concha <jose@zeroc.com>
-# Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017      Franek Korta <fkorta@gmail.com>
 # Licensed under the MIT license:
 #
@@ -105,6 +105,33 @@
       EXPAT_DLL: libexpatwd.dll
       APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
 
+    # Visual Studio 2022 Win32
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: Win32
+      CMAKE_ARGS: -A Win32
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+    # Visual Studio 2022 Win32 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: Win32
+      CMAKE_ARGS: -A Win32 -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+    # Visual Studio 2022 x64
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: x64
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+    # Visual Studio 2022 x64 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: x64
+      CMAKE_ARGS: -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
 before_build:
   - echo Running cmake...
   - cd c:\projects\libexpat
diff --git a/expat/CMake.README b/expat/CMake.README
index be805e4..a050230 100644
--- a/expat/CMake.README
+++ b/expat/CMake.README
@@ -3,25 +3,25 @@
 The cmake based buildsystem for expat works on Windows (cygwin, mingw, Visual
 Studio) and should work on all other platform cmake supports.
 
-Assuming ~/expat-2.4.8 is the source directory of expat, add a subdirectory
+Assuming ~/expat-2.4.9 is the source directory of expat, add a subdirectory
 build and change into that directory:
-~/expat-2.4.8$ mkdir build && cd build
-~/expat-2.4.8/build$
+~/expat-2.4.9$ mkdir build && cd build
+~/expat-2.4.9/build$
 
 From that directory, call cmake first, then call make, make test and
 make install in the usual way:
-~/expat-2.4.8/build$ cmake ..
+~/expat-2.4.9/build$ cmake ..
 -- The C compiler identification is GNU
 -- The CXX compiler identification is GNU
 ....
 -- Configuring done
 -- Generating done
--- Build files have been written to: /home/patrick/expat-2.4.8/build
+-- Build files have been written to: /home/patrick/expat-2.4.9/build
 
 If you want to specify the install location for your files, append
 -DCMAKE_INSTALL_PREFIX=/your/install/path to the cmake call.
 
-~/expat-2.4.8/build$ make && make test && make install
+~/expat-2.4.9/build$ make && make test && make install
 Scanning dependencies of target expat
 [  5%] Building C object CMakeFiles/expat.dir/lib/xmlparse.c.o
 [ 11%] Building C object CMakeFiles/expat.dir/lib/xmlrole.c.o
diff --git a/expat/CMakeLists.txt b/expat/CMakeLists.txt
index 6797fd4..170ff18 100644
--- a/expat/CMakeLists.txt
+++ b/expat/CMakeLists.txt
@@ -30,42 +30,15 @@
 # Copyright (c) 2020      Thomas Beutlich <tc@tbeu.de>
 # Copyright (c) 2021      Alex Richardson <Alexander.Richardson@cl.cam.ac.uk>
 # Copyright (c) 2022      Johnny Jazeix <jazeix@gmail.com>
+# Copyright (c) 2022      David Faure <david.faure@kdab.com>
 # Unlike most of Expat,
 # this file is copyrighted under the BSD-license for buildsystem files of KDE.
 
 cmake_minimum_required(VERSION 3.1.3)
 
-# This allows controlling documented build time switches
-# when Expat is pulled in using the add_subdirectory function, e.g.
-#
-#   set(EXPAT_BUILD_DOCS OFF)
-#   set(EXPAT_BUILD_TOOLS OFF)
-#   add_subdirectory(${expat_SOURCE_DIR}/expat ${expat_BINARY_DIR})
-#
-# would disable compilation of the xmlwf CLI and its man page.
-# Without activating behaviour NEW for policy CMP0077 here,
-# a user with -Wdev enabled would see warning
-#
-#   Policy CMP0077 is not set: option() honors normal variables.  Run "cmake
-#   --help-policy CMP0077" for policy details.  Use the cmake_policy command to
-#   set the policy and suppress this warning.
-#
-#   For compatibility with older versions of CMake, option is clearing the
-#   normal variable 'EXPAT_BUILD_DOCS'.
-#
-# and effectively not be able to adjust option EXPAT_BUILD_DOCS.
-#
-# For more details please see:
-# - https://cmake.org/cmake/help/latest/policy/CMP0077.html
-# - https://github.com/libexpat/libexpat/pull/419
-#
-if(POLICY CMP0077)
-    cmake_policy(SET CMP0077 NEW)
-endif()
-
 project(expat
     VERSION
-        2.4.8
+        2.4.9
     LANGUAGES
         C
 )
@@ -108,52 +81,87 @@
     set(_EXPAT_SHARED_LIBS_DEFAULT ON)
 endif()
 if(NOT CMAKE_BUILD_TYPE)
-    set(CMAKE_BUILD_TYPE NoConfig)  # so that accessing CMAKE_*_POSTFIX will be waterproof
+    set(CMAKE_BUILD_TYPE NoConfig)  # so that accessing EXPAT_*_POSTFIX will be waterproof
 endif()
 string(TOUPPER "${CMAKE_BUILD_TYPE}" _EXPAT_BUILD_TYPE_UPPER)
 
 #
 # Configuration
 #
-option(EXPAT_BUILD_TOOLS "build the xmlwf tool for expat library" ${_EXPAT_BUILD_TOOLS_DEFAULT})
-option(EXPAT_BUILD_EXAMPLES "build the examples for expat library" ON)
-option(EXPAT_BUILD_TESTS "build the tests for expat library" ON)
-option(EXPAT_SHARED_LIBS "build a shared expat library" ${_EXPAT_SHARED_LIBS_DEFAULT})
-option(EXPAT_BUILD_DOCS "build man page for xmlwf" ${_EXPAT_BUILD_DOCS_DEFAULT})
-option(EXPAT_BUILD_FUZZERS "build fuzzers for the expat library" OFF)
-option(EXPAT_BUILD_PKGCONFIG "build pkg-config file" ${_EXPAT_BUILD_PKGCONFIG_DEFAULT})
-option(EXPAT_OSSFUZZ_BUILD "build fuzzers via ossfuzz for the expat library" OFF)
+
+macro(expat_shy_set var default cache type desc)
+    # Macro expat_shy_set came into life because:
+    # - Expat was previously using an inconsistent mix of CMake's native set()
+    #   and option() to define public build time options.
+    # - option() is more friendly than set() with regard to configuring an
+    #   external project that is pulled in by means of add_subdirectory() --
+    #   see comments in issue #597 -- so we wanted to get away from set().
+    # - option() auto-converts non-bool values to bool when writing to the CMake
+    #   cache, so we needed something that supports non-bool better and hence
+    #   wanted to get away from plain option(), too.
+    #
+    # As a result, this function serves as a hybrid between CMake's regular set()
+    # and option(): from set() it takes support for non-bool types and the function
+    # name and signature whereas from option() (with policy CMP0077 mode NEW) it
+    # takes being shy when a value has previously been defined for that variable.
+    #
+    # So that resolves all need for set(.. FORCE) when pulling in Expat by means of
+    # add_subdirectory().
+    #
+    if(NOT ${cache} STREQUAL "CACHE")
+        message(SEND_ERROR "Macro usage is: expat_shy_set(var default CACHE type desc)")
+    endif()
+
+    if(DEFINED ${var})
+        # NOTE: The idea is to (ideally) only add to the cache if
+        #       there is no cache entry, yet.  "if(DEFINED CACHE{var})"
+        #       requires CMake >=3.14.
+        if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.14" AND NOT DEFINED "CACHE{${var}}")
+            set("${var}" "${${var}}" CACHE "${type}" "${desc}")
+        endif()
+    else()
+        set("${var}" "${default}" CACHE "${type}" "${desc}")
+    endif()
+endmacro()
+
+expat_shy_set(EXPAT_BUILD_TOOLS ${_EXPAT_BUILD_TOOLS_DEFAULT} CACHE BOOL "Build the xmlwf tool for expat library")
+expat_shy_set(EXPAT_BUILD_EXAMPLES ON CACHE BOOL "Build the examples for expat library")
+expat_shy_set(EXPAT_BUILD_TESTS ON CACHE BOOL "Build the tests for expat library")
+expat_shy_set(EXPAT_SHARED_LIBS ${_EXPAT_SHARED_LIBS_DEFAULT} CACHE BOOL "Build a shared expat library")
+expat_shy_set(EXPAT_BUILD_DOCS ${_EXPAT_BUILD_DOCS_DEFAULT} CACHE BOOL "Build man page for xmlwf")
+expat_shy_set(EXPAT_BUILD_FUZZERS OFF CACHE BOOL "Build fuzzers for the expat library")
+expat_shy_set(EXPAT_BUILD_PKGCONFIG ${_EXPAT_BUILD_PKGCONFIG_DEFAULT} CACHE BOOL "Build pkg-config file")
+expat_shy_set(EXPAT_OSSFUZZ_BUILD OFF CACHE BOOL "Build fuzzers via ossfuzz for the expat library")
 if(UNIX OR _EXPAT_HELP)
-    option(EXPAT_WITH_LIBBSD "utilize libbsd (for arc4random_buf)" OFF)
+    expat_shy_set(EXPAT_WITH_LIBBSD OFF CACHE BOOL "Utilize libbsd (for arc4random_buf)")
 endif()
-option(EXPAT_ENABLE_INSTALL "install expat files in cmake install target" ON)
-set(EXPAT_CONTEXT_BYTES 1024 CACHE STRING "Define to specify how much context to retain around the current parse point")
+expat_shy_set(EXPAT_ENABLE_INSTALL ON CACHE BOOL "Install expat files in cmake install target")
+expat_shy_set(EXPAT_CONTEXT_BYTES 1024 CACHE STRING "Define to specify how much context to retain around the current parse point")
 mark_as_advanced(EXPAT_CONTEXT_BYTES)
-option(EXPAT_DTD "Define to make parameter entity parsing functionality available" ON)
+expat_shy_set(EXPAT_DTD ON CACHE BOOL "Define to make parameter entity parsing functionality available")
 mark_as_advanced(EXPAT_DTD)
-option(EXPAT_NS "Define to make XML Namespaces functionality available" ON)
+expat_shy_set(EXPAT_NS ON CACHE BOOL "Define to make XML Namespaces functionality available")
 mark_as_advanced(EXPAT_NS)
-option(EXPAT_WARNINGS_AS_ERRORS "Treat all compiler warnings as errors" OFF)
+expat_shy_set(EXPAT_WARNINGS_AS_ERRORS OFF CACHE BOOL "Treat all compiler warnings as errors")
 if(UNIX OR _EXPAT_HELP)
-    option(EXPAT_DEV_URANDOM "Define to include code reading entropy from `/dev/urandom'." ON)
-    set(EXPAT_WITH_GETRANDOM "AUTO" CACHE STRING
-            "Make use of getrandom function (ON|OFF|AUTO) [default=AUTO]")
-    set(EXPAT_WITH_SYS_GETRANDOM "AUTO" CACHE STRING
-            "Make use of syscall SYS_getrandom (ON|OFF|AUTO) [default=AUTO]")
+    expat_shy_set(EXPAT_DEV_URANDOM ON CACHE BOOL "Define to include code reading entropy from `/dev/urandom'.")
+    expat_shy_set(EXPAT_WITH_GETRANDOM "AUTO" CACHE STRING "Make use of getrandom function (ON|OFF|AUTO) [default=AUTO]")
+    expat_shy_set(EXPAT_WITH_SYS_GETRANDOM "AUTO" CACHE STRING "Make use of syscall SYS_getrandom (ON|OFF|AUTO) [default=AUTO]")
     mark_as_advanced(EXPAT_DEV_URANDOM)
 endif()
-set(EXPAT_CHAR_TYPE "char" CACHE STRING "Character type to use (char|ushort|wchar_t) [default=char]")
-option(EXPAT_ATTR_INFO "Define to allow retrieving the byte offsets for attribute names and values" OFF)
+expat_shy_set(EXPAT_CHAR_TYPE "char" CACHE STRING "Character type to use (char|ushort|wchar_t) [default=char]")
+expat_shy_set(EXPAT_ATTR_INFO OFF CACHE BOOL "Define to allow retrieving the byte offsets for attribute names and values")
 mark_as_advanced(EXPAT_ATTR_INFO)
-option(EXPAT_LARGE_SIZE "Make XML_GetCurrent* functions return <(unsigned) long long> rather than <(unsigned) long>" OFF)
+expat_shy_set(EXPAT_LARGE_SIZE OFF CACHE BOOL "Make XML_GetCurrent* functions return <(unsigned) long long> rather than <(unsigned) long>")
 mark_as_advanced(EXPAT_LARGE_SIZE)
-option(EXPAT_MIN_SIZE "Get a smaller (but slower) parser (in particular avoid multiple copies of the tokenizer)" OFF)
+expat_shy_set(EXPAT_MIN_SIZE OFF CACHE BOOL "Get a smaller (but slower) parser (in particular avoid multiple copies of the tokenizer)")
 mark_as_advanced(EXPAT_MIN_SIZE)
 if(MSVC OR _EXPAT_HELP)
-    set(EXPAT_MSVC_STATIC_CRT OFF CACHE BOOL "Use /MT flag (static CRT) when compiling in MSVC")
+    expat_shy_set(EXPAT_MSVC_STATIC_CRT OFF CACHE BOOL "Use /MT flag (static CRT) when compiling in MSVC")
 endif()
 if(NOT _EXPAT_HELP)
-    set(_EXPAT_M32 OFF CACHE BOOL "(Unofficial!) Produce 32bit code with -m32")
+    expat_shy_set(_EXPAT_M32 OFF CACHE BOOL "(Unofficial!) Produce 32bit code with -m32")
+    mark_as_advanced(_EXPAT_M32)
 endif()
 
 if(EXPAT_BUILD_TESTS)
@@ -289,7 +297,9 @@
     set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -fno-strict-aliasing")
 endif()
 if(FLAG_VISIBILITY)
-  add_definitions(-DXML_ENABLE_VISIBILITY=1)
+  if(EXPAT_SHARED_LIBS)
+     add_definitions(-DXML_ENABLE_VISIBILITY=1)
+  endif()
   set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -fvisibility=hidden")
 endif()
 if(MINGW)
@@ -349,37 +359,6 @@
 endif()
 
 #
-# Library filename postfix
-#
-if(_EXPAT_UNICODE)
-    set(_POSTFIX_WIDE "w")
-endif()
-
-if(MSVC AND NOT EXPAT_SHARED_LIBS)
-    if(EXPAT_MSVC_STATIC_CRT)
-        set(_POSTFIX_CRT "MT")
-    else()
-        set(_POSTFIX_CRT "MD")
-    endif()
-endif()
-
-foreach(postfix_var
-        CMAKE_${_EXPAT_BUILD_TYPE_UPPER}_POSTFIX
-        CMAKE_DEBUG_POSTFIX
-        CMAKE_RELEASE_POSTFIX
-        CMAKE_MINSIZEREL_POSTFIX
-        CMAKE_RELWITHDEBINFO_POSTFIX
-        )
-    if(WIN32 AND postfix_var STREQUAL "CMAKE_DEBUG_POSTFIX")
-        set(_POSTFIX_DEBUG "d")
-    else()
-        set(_POSTFIX_DEBUG "")  # needs a reset because of being looped
-    endif()
-
-    set(${postfix_var} "${_POSTFIX_WIDE}${_POSTFIX_DEBUG}${_POSTFIX_CRT}" CACHE STRING "Library filename postfix, e.g. libexpat<postfix=[w][d][MD|MT]>.lib")
-endforeach()
-
-#
 # C library
 #
 set(_EXPAT_C_SOURCES
@@ -393,10 +372,21 @@
 
 if(EXPAT_SHARED_LIBS)
     set(_SHARED SHARED)
-    if(MSVC)
-        set(_EXPAT_EXTRA_SOURCES ${_EXPAT_EXTRA_SOURCES} lib/libexpat.def)
-    endif()
     if(WIN32)
+        macro(_expat_def_file_toggle source_var target_var)
+            if(${source_var})
+                set(${target_var} " ")  # i.e. not commented out, a single space
+            else()
+                set(${target_var} ";")  # i.e. commented out
+            endif()
+        endmacro()
+
+        _expat_def_file_toggle(EXPAT_DTD _EXPAT_COMMENT_DTD)
+        _expat_def_file_toggle(EXPAT_ATTR_INFO _EXPAT_COMMENT_ATTR_INFO)
+
+        configure_file("${CMAKE_CURRENT_SOURCE_DIR}/lib/libexpat.def.cmake" "${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.def")
+        set(_EXPAT_EXTRA_SOURCES ${_EXPAT_EXTRA_SOURCES} "${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.def")
+
         # Add DLL version
         string(REPLACE "." "," _EXPAT_DLL_VERSION ${PROJECT_VERSION}.0)
         set(_EXPAT_EXTRA_SOURCES ${_EXPAT_EXTRA_SOURCES} win32/version.rc)
@@ -413,8 +403,41 @@
     target_link_libraries(expat ${LIB_BSD})
 endif()
 
+#
+# Library filename postfix
+#
+if(_EXPAT_UNICODE)
+    set(_POSTFIX_WIDE "w")
+endif()
+
+if(MSVC AND NOT EXPAT_SHARED_LIBS)
+    if(EXPAT_MSVC_STATIC_CRT)
+        set(_POSTFIX_CRT "MT")
+    else()
+        set(_POSTFIX_CRT "MD")
+    endif()
+endif()
+
+foreach(build_type_upper
+        ${_EXPAT_BUILD_TYPE_UPPER}
+        DEBUG
+        RELEASE
+        MINSIZEREL
+        RELWITHDEBINFO
+        )
+    if(WIN32 AND build_type_upper STREQUAL "DEBUG")
+        set(_POSTFIX_DEBUG "d")
+    else()
+        set(_POSTFIX_DEBUG "")  # needs a reset because of being looped
+    endif()
+
+    expat_shy_set(EXPAT_${build_type_upper}_POSTFIX "${_POSTFIX_WIDE}${_POSTFIX_DEBUG}${_POSTFIX_CRT}" CACHE STRING "Library filename postfix for build type ${build_type_upper}; yields filenames libexpat<postfix=[w][d][MD|MT]>.(dll|dylib|lib|so)")
+    mark_as_advanced(EXPAT_${build_type_upper}_POSTFIX)
+    set_property(TARGET expat PROPERTY ${build_type_upper}_POSTFIX ${EXPAT_${build_type_upper}_POSTFIX})
+endforeach()
+
 set(LIBCURRENT 9)   # sync
-set(LIBREVISION 8)  # with
+set(LIBREVISION 9)  # with
 set(LIBAGE 8)       # configure.ac!
 math(EXPR LIBCURRENT_MINUS_AGE "${LIBCURRENT} - ${LIBAGE}")
 
@@ -435,6 +458,11 @@
         set_property(TARGET expat PROPERTY MACHO_CURRENT_VERSION ${_EXPAT_MACHO_CURRENT_VERSION})
     endif()
 endif()
+
+if(MINGW)
+    set_target_properties(expat PROPERTIES SUFFIX "-${LIBCURRENT_MINUS_AGE}.dll")
+endif()
+
 if(WIN32 AND NOT MINGW)
     # NOTE: This avoids a name collision with Expat.dll of Perl's XML::Parser::Expat
     #       on Windows by resorting to filename libexpat.dll since Expat 1.95.3.
@@ -455,12 +483,8 @@
         $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
 )
 
-if(WIN32)
-    if(EXPAT_SHARED_LIBS)
-        target_compile_definitions(expat PRIVATE VER_FILEVERSION=${_EXPAT_DLL_VERSION})
-    else()
-        target_compile_definitions(expat PUBLIC -DXML_STATIC)
-    endif()
+if(WIN32 AND EXPAT_SHARED_LIBS)
+    target_compile_definitions(expat PRIVATE VER_FILEVERSION=${_EXPAT_DLL_VERSION})
 endif()
 
 expat_install(TARGETS expat EXPORT expat
@@ -594,25 +618,27 @@
         endif()
     endfunction()
 
-    add_executable(runtests tests/runtests.c ${test_SRCS})
-    set_property(TARGET runtests PROPERTY RUNTIME_OUTPUT_DIRECTORY tests)
-    expat_add_test(runtests $<TARGET_FILE:runtests>)
-
+    set(_EXPAT_TEST_TARGETS runtests runtestspp)
+    add_executable(runtests   tests/runtests.c     ${test_SRCS})
     add_executable(runtestspp tests/runtestspp.cpp ${test_SRCS})
-    set_property(TARGET runtestspp PROPERTY RUNTIME_OUTPUT_DIRECTORY tests)
-    expat_add_test(runtestspp $<TARGET_FILE:runtestspp>)
 
-    if(_EXPAT_LIBM_FOUND)
-        target_link_libraries(runtests m)
-        target_link_libraries(runtestspp m)
-    endif()
+    foreach(_target ${_EXPAT_TEST_TARGETS})
+        set_property(TARGET ${_target} PROPERTY RUNTIME_OUTPUT_DIRECTORY tests)
+        expat_add_test(${_target} $<TARGET_FILE:${_target}>)
 
-    if(EXPAT_WITH_LIBBSD)
-        target_link_libraries(runtests ${LIB_BSD})
-        target_link_libraries(runtestspp ${LIB_BSD})
-    endif()
+        if(_EXPAT_LIBM_FOUND)
+            target_link_libraries(${_target} m)
+        endif()
+
+        if(EXPAT_WITH_LIBBSD)
+            target_link_libraries(${_target} ${LIB_BSD})
+        endif()
+    endforeach()
 endif()
 
+#
+# Fuzzers
+#
 if(EXPAT_BUILD_FUZZERS)
     if(NOT "${CMAKE_C_COMPILER_ID}" STREQUAL "Clang")
         message(SEND_ERROR
@@ -681,6 +707,23 @@
 endif()
 
 #
+# C/C++ config affecting multiple targets
+#
+if(WIN32)
+    set(_EXPAT_STATIC_TARGETS ${_EXPAT_TEST_TARGETS})
+    if(NOT EXPAT_SHARED_LIBS)
+        list(APPEND _EXPAT_STATIC_TARGETS expat)
+    endif()
+    if(EXPAT_BUILD_FUZZERS)
+        list(APPEND _EXPAT_STATIC_TARGETS fuzzpat)
+    endif()
+
+    foreach(_target ${_EXPAT_STATIC_TARGETS})
+        target_compile_definitions(${_target} PUBLIC -DXML_STATIC)
+    endforeach()
+endif()
+
+#
 # Custom target "run-xmltest"
 #
 if(EXPAT_BUILD_TOOLS AND NOT MSVC)
@@ -834,7 +877,7 @@
 endif()
 message(STATUS "  Character type ............. ${_EXPAT_CHAR_TYPE_SUMMARY}")
 if(NOT _EXPAT_GENERATOR_IS_MULTI_CONFIG)
-    message(STATUS "  Library name postfix ....... ${CMAKE_${_EXPAT_BUILD_TYPE_UPPER}_POSTFIX}")
+    message(STATUS "  Library name postfix ....... ${EXPAT_${_EXPAT_BUILD_TYPE_UPPER}_POSTFIX}")
 endif()
 message(STATUS "")
 message(STATUS "  Build documentation ........ ${EXPAT_BUILD_DOCS}")
diff --git a/expat/COPYING b/expat/COPYING
index 3c0142e..ce9e593 100644
--- a/expat/COPYING
+++ b/expat/COPYING
@@ -1,5 +1,5 @@
 Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper
-Copyright (c) 2001-2019 Expat maintainers
+Copyright (c) 2001-2022 Expat maintainers
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
diff --git a/expat/Changes b/expat/Changes
index 918c939..cfc83a0 100644
--- a/expat/Changes
+++ b/expat/Changes
@@ -2,6 +2,69 @@
       https://github.com/libexpat/libexpat/labels/help%20wanted
       If you can help, please get in touch.  Thanks!
 
+Release 2.4.9 Tue September 20 2022
+        Security fixes:
+       #629 #640  CVE-2022-40674 -- Heap use-after-free vulnerability in
+                    function doContent. Expected impact is denial of service
+                    or potentially arbitrary code execution.
+
+        Bug fixes:
+            #634  MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
+            #614  docs: Fix documentation on effect of switch XML_DTD on
+                    symbol visibility in doc/reference.html
+
+        Other changes:
+            #638  MinGW: Make fix-xmltest-log.sh drop more Wine bug output
+       #596 #625  Autotools: Sync CMake templates with CMake 3.22
+            #608  CMake: Migrate from use of CMAKE_*_POSTFIX to
+                    dedicated variables EXPAT_*_POSTFIX to stop affecting
+                    other projects
+       #597 #599  Windows|CMake: Add missing -DXML_STATIC to test runners
+                    and fuzzers
+       #512 #621  Windows|CMake: Render .def file from a template to fix
+                    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
+       #611 #621  MinGW|CMake: Apply MSVC .def file when linking
+       #622 #624  MinGW|CMake: Sync library name with GNU Autotools,
+                    i.e. produce libexpat-1.dll rather than libexpat.dll
+                    by default.  Filename libexpat.dll.a is unaffected.
+            #632  MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
+                    toolchain file "cmake/mingw-toolchain.cmake" to avoid
+                    error "windres: Command not found" on e.g. Ubuntu 20.04
+       #597 #627  CMake: Unify inconsistent use of set() and option() in
+                    context of public build time options to take need for
+                    set(.. FORCE) in projects using Expat by means of
+                    add_subdirectory(..) off Expat's users' shoulders
+       #626 #641  Stop exporting API symbols when building a static library
+            #644  Resolve use of deprecated "fgrep" by "grep -F"
+            #620  CMake: Make documentation on variables a bit more consistent
+            #636  CMake: Drop leading whitespace from a #cmakedefine line in
+                    file expat_config.h.cmake
+            #594  xmlwf: Fix harmless variable mix-up in function nsattcmp
+  #592 #593 #610  Address Cppcheck warnings
+            #643  Address Clang 15 compiler warnings
+       #642 #644  Version info bumped from 9:8:8 to 9:9:8;
+                    see https://verbump.de/ for what these numbers do
+
+        Infrastructure:
+       #597 #598  CI: Windows: Start covering MSVC 2022
+            #619  CI: macOS: Migrate off deprecated macOS 10.15
+            #632  CI: Linux: Make migration off deprecated Ubuntu 18.04 work
+            #643  CI: Upgrade Clang from 14 to 15
+            #637  apply-clang-format.sh: Add support for BSD find
+            #633  coverage.sh: Exclude MinGW headers
+            #635  coverage.sh: Fix name collision for -funsigned-char
+
+        Special thanks to:
+            David Faure
+            Felix Wilhelm
+            Frank Bergmann
+            Rhodri James
+            Rosen Penev
+            Thijs Schreijer
+            Vincent Torri
+                 and
+            Google Project Zero
+
 Release 2.4.8 Mon March 28 2022
         Other changes:
             #587  pkg-config: Move "-lm" to section "Libs.private"
@@ -209,7 +272,7 @@
             #498  Autotools: Include files with release archives:
                     - buildconf.sh
                     - fuzz/*.c
-       #507 #519  Autotools: Sync CMake templates
+       #507 #519  Autotools: Sync CMake templates with CMake 3.20
        #495 #524  CMake: MinGW: Fix pkg-config section "Libs" for
                     - non-release build types (e.g. -DCMAKE_BUILD_TYPE=Debug)
                     - multi-config CMake generators (e.g. Ninja Multi-Config)
@@ -283,6 +346,7 @@
        #468 #469  xmlwf: Improve help output and the xmlwf man page
             #463  xmlwf: Improve maintainability through some refactoring
             #477  xmlwf: Fix man page DocBook validity
+            #456  Autotools: Sync CMake templates with CMake 3.18
        #458 #459  CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR
                     and CMAKE_INSTALL_INCLUDEDIR
        #471 #481  CMake: Add support for standard variable BUILD_SHARED_LIBS
diff --git a/expat/README.md b/expat/README.md
index 332ac95..c0ac8b0 100644
--- a/expat/README.md
+++ b/expat/README.md
@@ -5,7 +5,7 @@
 [![Downloads GitHub](https://img.shields.io/github/downloads/libexpat/libexpat/total?label=Downloads%20GitHub)](https://github.com/libexpat/libexpat/releases)
 
 
-# Expat, Release 2.4.8
+# Expat, Release 2.4.9
 
 This is Expat, a C library for parsing XML, started by
 [James Clark](https://en.wikipedia.org/wiki/James_Clark_%28programmer%29) in 1997.
@@ -222,37 +222,37 @@
 // Path to a program.
 DOCBOOK_TO_MAN:FILEPATH=/usr/bin/docbook2x-man
 
-// build man page for xmlwf
+// Build man page for xmlwf
 EXPAT_BUILD_DOCS:BOOL=ON
 
-// build the examples for expat library
+// Build the examples for expat library
 EXPAT_BUILD_EXAMPLES:BOOL=ON
 
-// build fuzzers for the expat library
+// Build fuzzers for the expat library
 EXPAT_BUILD_FUZZERS:BOOL=OFF
 
-// build pkg-config file
+// Build pkg-config file
 EXPAT_BUILD_PKGCONFIG:BOOL=ON
 
-// build the tests for expat library
+// Build the tests for expat library
 EXPAT_BUILD_TESTS:BOOL=ON
 
-// build the xmlwf tool for expat library
+// Build the xmlwf tool for expat library
 EXPAT_BUILD_TOOLS:BOOL=ON
 
 // Character type to use (char|ushort|wchar_t) [default=char]
 EXPAT_CHAR_TYPE:STRING=char
 
-// install expat files in cmake install target
+// Install expat files in cmake install target
 EXPAT_ENABLE_INSTALL:BOOL=ON
 
 // Use /MT flag (static CRT) when compiling in MSVC
 EXPAT_MSVC_STATIC_CRT:BOOL=OFF
 
-// build fuzzers via ossfuzz for the expat library
+// Build fuzzers via ossfuzz for the expat library
 EXPAT_OSSFUZZ_BUILD:BOOL=OFF
 
-// build a shared expat library
+// Build a shared expat library
 EXPAT_SHARED_LIBS:BOOL=ON
 
 // Treat all compiler warnings as errors
@@ -261,7 +261,7 @@
 // Make use of getrandom function (ON|OFF|AUTO) [default=AUTO]
 EXPAT_WITH_GETRANDOM:STRING=AUTO
 
-// utilize libbsd (for arc4random_buf)
+// Utilize libbsd (for arc4random_buf)
 EXPAT_WITH_LIBBSD:BOOL=OFF
 
 // Make use of syscall SYS_getrandom (ON|OFF|AUTO) [default=AUTO]
diff --git a/expat/apply-clang-format.sh b/expat/apply-clang-format.sh
index ebc24c0..d13b432 100755
--- a/expat/apply-clang-format.sh
+++ b/expat/apply-clang-format.sh
@@ -6,7 +6,8 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2019-2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2019-2022 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2022      Rosen Penev <rosenp@gmail.com>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -46,7 +47,7 @@
 
 expand --tabs=2 --initial lib/siphash.h | sponge lib/siphash.h
 
-find \
+find . \
         -name '*.[ch]' \
         -o -name '*.cpp' \
         -o -name '*.cxx' \
@@ -56,6 +57,6 @@
 
 sed \
         -e 's, @$,@,' \
-        -e 's,#\( \+\)cmakedefine,\1#cmakedefine,' \
+        -e 's,#\( \+\)cmakedefine,#cmakedefine,' \
         -i \
         expat_config.h.cmake
diff --git a/expat/buildconf.sh b/expat/buildconf.sh
index 5edbc56..5e2b326 100755
--- a/expat/buildconf.sh
+++ b/expat/buildconf.sh
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2018      Marco Maggi <marco.maggi-ipsu@poste.it>
 # Licensed under the MIT license:
 #
@@ -40,7 +40,7 @@
 # not put SIZEOF_VOID_P in the eventual expat_config.h.
 patch_expat_config_h_in() {
     local filename="$1"
-    local sizeof_void_p_line_number="$(fgrep -n SIZEOF_VOID_P "${filename}" | awk -F: '{print $1}')"
+    local sizeof_void_p_line_number="$(grep -F -n SIZEOF_VOID_P "${filename}" | awk -F: '{print $1}')"
     [[ ${sizeof_void_p_line_number} =~ ^[0-9]+$ ]]  # cheap assert
     local first_line_to_delete=$(( sizeof_void_p_line_number - 1 ))
     local last_line_to_delete=$(( sizeof_void_p_line_number + 1 ))
diff --git a/expat/cmake/autotools/expat-noconfig__linux.cmake.in b/expat/cmake/autotools/expat-noconfig__linux.cmake.in
index 2726e48..d0ad645 100644
--- a/expat/cmake/autotools/expat-noconfig__linux.cmake.in
+++ b/expat/cmake/autotools/expat-noconfig__linux.cmake.in
@@ -12,8 +12,8 @@
   IMPORTED_SONAME_NOCONFIG "libexpat.so.@SO_MAJOR@"
   )
 
-list(APPEND _IMPORT_CHECK_TARGETS expat::expat )
-list(APPEND _IMPORT_CHECK_FILES_FOR_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.so.@SO_MAJOR@.@SO_MINOR@.@SO_PATCH@" )
+list(APPEND _cmake_import_check_targets expat::expat )
+list(APPEND _cmake_import_check_files_for_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.so.@SO_MAJOR@.@SO_MINOR@.@SO_PATCH@" )
 
 # Commands beyond this point should not need to know the version.
 set(CMAKE_IMPORT_FILE_VERSION)
diff --git a/expat/cmake/autotools/expat-noconfig__macos.cmake.in b/expat/cmake/autotools/expat-noconfig__macos.cmake.in
index 0485cc6..bb48d98 100644
--- a/expat/cmake/autotools/expat-noconfig__macos.cmake.in
+++ b/expat/cmake/autotools/expat-noconfig__macos.cmake.in
@@ -12,8 +12,8 @@
   IMPORTED_SONAME_NOCONFIG "@rpath/libexpat.@SO_MAJOR@.dylib"
   )
 
-list(APPEND _IMPORT_CHECK_TARGETS expat::expat )
-list(APPEND _IMPORT_CHECK_FILES_FOR_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.@SO_MAJOR@.@SO_MINOR@.@SO_PATCH@.dylib" )
+list(APPEND _cmake_import_check_targets expat::expat )
+list(APPEND _cmake_import_check_files_for_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.@SO_MAJOR@.@SO_MINOR@.@SO_PATCH@.dylib" )
 
 # Commands beyond this point should not need to know the version.
 set(CMAKE_IMPORT_FILE_VERSION)
diff --git a/expat/cmake/autotools/expat-noconfig__windows.cmake.in b/expat/cmake/autotools/expat-noconfig__windows.cmake.in
index cbed0ec..2f7454e 100644
--- a/expat/cmake/autotools/expat-noconfig__windows.cmake.in
+++ b/expat/cmake/autotools/expat-noconfig__windows.cmake.in
@@ -12,8 +12,8 @@
   IMPORTED_LOCATION_NOCONFIG "${_IMPORT_PREFIX}/bin/@CMAKE_SHARED_LIBRARY_PREFIX@expat-@SO_MAJOR@.dll"
   )
 
-list(APPEND _IMPORT_CHECK_TARGETS expat::expat )
-list(APPEND _IMPORT_CHECK_FILES_FOR_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.dll.a" "${_IMPORT_PREFIX}/bin/@CMAKE_SHARED_LIBRARY_PREFIX@expat-@SO_MAJOR@.dll" )
+list(APPEND _cmake_import_check_targets expat::expat )
+list(APPEND _cmake_import_check_files_for_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.dll.a" "${_IMPORT_PREFIX}/bin/@CMAKE_SHARED_LIBRARY_PREFIX@expat-@SO_MAJOR@.dll" )
 
 # Commands beyond this point should not need to know the version.
 set(CMAKE_IMPORT_FILE_VERSION)
diff --git a/expat/cmake/autotools/expat.cmake b/expat/cmake/autotools/expat.cmake
index 24b5d92..5eb47b9 100644
--- a/expat/cmake/autotools/expat.cmake
+++ b/expat/cmake/autotools/expat.cmake
@@ -1,10 +1,13 @@
 # Generated by CMake
 
-if("${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}" LESS 2.6)
-   message(FATAL_ERROR "CMake >= 2.6.0 required")
+if("${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}" LESS 2.8)
+   message(FATAL_ERROR "CMake >= 2.8.0 required")
+endif()
+if(CMAKE_VERSION VERSION_LESS "2.8.3")
+   message(FATAL_ERROR "CMake >= 2.8.3 required")
 endif()
 cmake_policy(PUSH)
-cmake_policy(VERSION 2.6...3.20)
+cmake_policy(VERSION 2.8.3...3.22)
 #----------------------------------------------------------------
 # Generated CMake target import file.
 #----------------------------------------------------------------
@@ -13,32 +16,34 @@
 set(CMAKE_IMPORT_FILE_VERSION 1)
 
 # Protect against multiple inclusion, which would fail when already imported targets are added once more.
-set(_targetsDefined)
-set(_targetsNotDefined)
-set(_expectedTargets)
-foreach(_expectedTarget expat::expat)
-  list(APPEND _expectedTargets ${_expectedTarget})
-  if(NOT TARGET ${_expectedTarget})
-    list(APPEND _targetsNotDefined ${_expectedTarget})
-  endif()
-  if(TARGET ${_expectedTarget})
-    list(APPEND _targetsDefined ${_expectedTarget})
+set(_cmake_targets_defined "")
+set(_cmake_targets_not_defined "")
+set(_cmake_expected_targets "")
+foreach(_cmake_expected_target IN ITEMS expat::expat)
+  list(APPEND _cmake_expected_targets "${_cmake_expected_target}")
+  if(TARGET "${_cmake_expected_target}")
+    list(APPEND _cmake_targets_defined "${_cmake_expected_target}")
+  else()
+    list(APPEND _cmake_targets_not_defined "${_cmake_expected_target}")
   endif()
 endforeach()
-if("${_targetsDefined}" STREQUAL "${_expectedTargets}")
-  unset(_targetsDefined)
-  unset(_targetsNotDefined)
-  unset(_expectedTargets)
-  set(CMAKE_IMPORT_FILE_VERSION)
+unset(_cmake_expected_target)
+if(_cmake_targets_defined STREQUAL _cmake_expected_targets)
+  unset(_cmake_targets_defined)
+  unset(_cmake_targets_not_defined)
+  unset(_cmake_expected_targets)
+  unset(CMAKE_IMPORT_FILE_VERSION)
   cmake_policy(POP)
   return()
 endif()
-if(NOT "${_targetsDefined}" STREQUAL "")
-  message(FATAL_ERROR "Some (but not all) targets in this export set were already defined.\nTargets Defined: ${_targetsDefined}\nTargets not yet defined: ${_targetsNotDefined}\n")
+if(NOT _cmake_targets_defined STREQUAL "")
+  string(REPLACE ";" ", " _cmake_targets_defined_text "${_cmake_targets_defined}")
+  string(REPLACE ";" ", " _cmake_targets_not_defined_text "${_cmake_targets_not_defined}")
+  message(FATAL_ERROR "Some (but not all) targets in this export set were already defined.\nTargets Defined: ${_cmake_targets_defined_text}\nTargets not yet defined: ${_cmake_targets_not_defined_text}\n")
 endif()
-unset(_targetsDefined)
-unset(_targetsNotDefined)
-unset(_expectedTargets)
+unset(_cmake_targets_defined)
+unset(_cmake_targets_not_defined)
+unset(_cmake_expected_targets)
 
 
 # Compute the installation prefix relative to this file.
@@ -63,21 +68,22 @@
 endif()
 
 # Load information for each installed configuration.
-get_filename_component(_DIR "${CMAKE_CURRENT_LIST_FILE}" PATH)
-file(GLOB CONFIG_FILES "${_DIR}/expat-*.cmake")
-foreach(f ${CONFIG_FILES})
-  include(${f})
+file(GLOB _cmake_config_files "${CMAKE_CURRENT_LIST_DIR}/expat-*.cmake")
+foreach(_cmake_config_file IN LISTS _cmake_config_files)
+  include("${_cmake_config_file}")
 endforeach()
+unset(_cmake_config_file)
+unset(_cmake_config_files)
 
 # Cleanup temporary variables.
 set(_IMPORT_PREFIX)
 
 # Loop over all imported files and verify that they actually exist
-foreach(target ${_IMPORT_CHECK_TARGETS} )
-  foreach(file ${_IMPORT_CHECK_FILES_FOR_${target}} )
-    if(NOT EXISTS "${file}" )
-      message(FATAL_ERROR "The imported target \"${target}\" references the file
-   \"${file}\"
+foreach(_cmake_target IN LISTS _cmake_import_check_targets)
+  foreach(_cmake_file IN LISTS "_cmake_import_check_files_for_${_cmake_target}")
+    if(NOT EXISTS "${_cmake_file}")
+      message(FATAL_ERROR "The imported target \"${_cmake_target}\" references the file
+   \"${_cmake_file}\"
 but this file does not exist.  Possible reasons include:
 * The file was deleted, renamed, or moved to another location.
 * An install or uninstall procedure did not complete successfully.
@@ -87,9 +93,11 @@
 ")
     endif()
   endforeach()
-  unset(_IMPORT_CHECK_FILES_FOR_${target})
+  unset(_cmake_file)
+  unset("_cmake_import_check_files_for_${_cmake_target}")
 endforeach()
-unset(_IMPORT_CHECK_TARGETS)
+unset(_cmake_target)
+unset(_cmake_import_check_targets)
 
 # This file does not depend on other imported targets which have
 # been exported from the same project but in a separate export set.
diff --git a/expat/cmake/mingw-toolchain.cmake b/expat/cmake/mingw-toolchain.cmake
index 31a238b..9032d9e 100644
--- a/expat/cmake/mingw-toolchain.cmake
+++ b/expat/cmake/mingw-toolchain.cmake
@@ -31,6 +31,7 @@
 
 set(CMAKE_C_COMPILER i686-w64-mingw32-gcc)
 set(CMAKE_CXX_COMPILER i686-w64-mingw32-g++)
+set(CMAKE_RC_COMPILER i686-w64-mingw32-windres)
 
 set(WIN32 ON)
 set(MINGW ON)
diff --git a/expat/configure.ac b/expat/configure.ac
index 4864025..4721694 100644
--- a/expat/configure.ac
+++ b/expat/configure.ac
@@ -82,7 +82,7 @@
 dnl
 
 LIBCURRENT=9   # sync
-LIBREVISION=8  # with
+LIBREVISION=9  # with
 LIBAGE=8       # CMakeLists.txt!
 
 AC_CONFIG_HEADERS([expat_config.h])
@@ -134,8 +134,9 @@
      [*linux*],[archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'])])
 
 EXPATCFG_COMPILER_SUPPORTS_VISIBILITY([
-  AX_APPEND_FLAG([-fvisibility=hidden],       [AM_CFLAGS])
-  AX_APPEND_FLAG([-DXML_ENABLE_VISIBILITY=1], [AM_CPPFLAGS])])
+  AX_APPEND_FLAG([-fvisibility=hidden],              [AM_CFLAGS])
+  AS_IF([test "${enable_shared}" = yes],
+        [AX_APPEND_FLAG([-DXML_ENABLE_VISIBILITY=1], [AM_CPPFLAGS])])])
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 
diff --git a/expat/coverage.sh b/expat/coverage.sh
index 4126b6d..29855cc 100755
--- a/expat/coverage.sh
+++ b/expat/coverage.sh
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2018      Marco Maggi <marco.maggi-ipsu@poste.it>
 # Copyright (c) 2019      Mohammed Khajapasha <mohammed.khajapasha@intel.com>
 # Licensed under the MIT license:
@@ -51,11 +51,9 @@
 
     local char_part=
     if ${unicode_enabled}; then
-        if ${with_unsigned_char}; then
-            char_part=__ushort
-        else
-            char_part=__wchar_t
-        fi
+        char_part=__wchar_t
+    elif ${with_unsigned_char}; then
+        char_part=__uchar
     else
         char_part=__char
     fi
@@ -119,8 +117,8 @@
     # * coverage GCC flags make them needed
     # * With WINEDLLPATH Wine looks for .dll.so in these folders, not .dll
     local target="$1"
-    local mingw_gcc_dll_dir="$(dirname "$(ls -1 /usr/lib*/gcc/i686-w64-mingw32/*/libgcc_s_sjlj-1.dll | head -n1)")"
-    for dll in libgcc_s_sjlj-1.dll libstdc++-6.dll; do
+    local mingw_gcc_dll_dir="$(dirname "$(ls -1 /usr/lib*/gcc/i686-w64-mingw32/*/{libgcc_s_sjlj-1.dll,libstdc++-6.dll} | head -n1)")"
+    for dll in libgcc_s_dw2-1.dll libgcc_s_sjlj-1.dll libstdc++-6.dll; do
         (
             set -x
             ln -s "${mingw_gcc_dll_dir}"/${dll} "${target}"/${dll}
@@ -139,7 +137,7 @@
         done
     fi
 
-    for dll in libexpat{,w}.dll; do
+    for dll in libexpat{,w}-*.dll; do
         (
             set -x
             ln -s "${abs_build_dir}"/${dll} "${target}"/${dll}
@@ -230,9 +228,13 @@
 
 _clean_coverage_info() {
     local coverage_dir="$1"
-    local dir
-    for dir in CMakeFiles examples tests ; do
-        local pattern="*/${dir}/*"
+    local pattern
+    for pattern in \
+            '/usr/**mingw**/include/*' \
+            '*/CMakeFiles/*' \
+            '*/examples/*' \
+            '*/tests/*' \
+        ; do
         (
             set -x
             lcov -q -o "${coverage_dir}/${coverage_info}" -r "${coverage_dir}/${coverage_info}" "${pattern}"
diff --git a/expat/doc/reference.html b/expat/doc/reference.html
index 031c943..4ab8d5a 100644
--- a/expat/doc/reference.html
+++ b/expat/doc/reference.html
@@ -50,7 +50,7 @@
   <div>
     <h1>
       The Expat XML Parser
-      <small>Release 2.4.8</small>
+      <small>Release 2.4.9</small>
     </h1>
   </div>
 <div class="content">
@@ -365,8 +365,12 @@
 are reported and attribute value normalization occurs based on the
 type of attributes defined in the external subset.  Without
 this, Expat has a smaller memory footprint and can be faster, but will
-not load external entities or process conditional sections.  This does
-not affect the set of functions available in the API.</dd>
+not load external entities or process conditional sections. If defined, makes
+the functions <code><a 
+href="#XML_SetBillionLaughsAttackProtectionMaximumAmplification">
+XML_SetBillionLaughsAttackProtectionMaximumAmplification</a></code> and <code>
+<a href="#XML_SetBillionLaughsAttackProtectionActivationThreshold">
+XML_SetBillionLaughsAttackProtectionActivationThreshold</a></code> available.</dd>
 
 <dt>XML_NS</dt>
 <dd>When defined, support for the <cite><a href=
diff --git a/expat/doc/xmlwf.xml b/expat/doc/xmlwf.xml
index 48714b8..09d8dc8 100644
--- a/expat/doc/xmlwf.xml
+++ b/expat/doc/xmlwf.xml
@@ -21,7 +21,7 @@
           "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   <!ENTITY dhfirstname "<firstname>Scott</firstname>">
   <!ENTITY dhsurname   "<surname>Bronson</surname>">
-  <!ENTITY dhdate      "<date>March 28, 2022</date>">
+  <!ENTITY dhdate      "<date>September 20, 2022</date>">
   <!-- Please adjust this^^ date whenever cutting a new release. -->
   <!ENTITY dhsection   "<manvolnum>1</manvolnum>">
   <!ENTITY dhemail     "<email>bronson@rinspin.com</email>">
diff --git a/expat/expat_config.h.cmake b/expat/expat_config.h.cmake
index 173fed1..ee4adc6 100644
--- a/expat/expat_config.h.cmake
+++ b/expat/expat_config.h.cmake
@@ -94,7 +94,7 @@
 
 #if ! defined(_WIN32)
 /* Define to include code reading entropy from `/dev/urandom'. */
-  #cmakedefine XML_DEV_URANDOM
+#cmakedefine XML_DEV_URANDOM
 #endif
 
 /* Define to make parameter entity parsing functionality available. */
diff --git a/expat/fix-xmltest-log.sh b/expat/fix-xmltest-log.sh
index 164ea4e..7981cf3 100755
--- a/expat/fix-xmltest-log.sh
+++ b/expat/fix-xmltest-log.sh
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2019 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2019-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -42,6 +42,8 @@
         -e '/^Application tried to create a window, but no driver could be loaded.$/d' \
         -e '/^Make sure that your X server is running and that $DISPLAY is set correctly.$/d' \
         -e '/^err:systray:initialize_systray Could not create tray window$/d' \
+        -e '/^[0-9a-f]\+:err:/d' \
+        -e '/^wine client error:/d' \
         -e '/^In ibm\/invalid\/P49\/: Unhandled exception: unimplemented .\+/d' \
         \
         "${filename}" > "${tempfile}"
diff --git a/expat/fuzz/.gitignore b/expat/fuzz/.gitignore
index 5013245..2ea7444 100644
--- a/expat/fuzz/.gitignore
+++ b/expat/fuzz/.gitignore
@@ -1 +1,2 @@
 /xml_parse*
+!/xml_parse*.c
diff --git a/expat/lib/Makefile.am b/expat/lib/Makefile.am
index d540249..0e0185b 100644
--- a/expat/lib/Makefile.am
+++ b/expat/lib/Makefile.am
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017      Tomasz Kłoczko <kloczek@fedoraproject.org>
 # Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
 # Licensed under the MIT license:
@@ -74,8 +74,7 @@
     iasciitab.h \
     internal.h \
     latin1tab.h \
-    libexpat.def \
-    libexpatw.def \
+    libexpat.def.cmake \
     nametab.h \
     siphash.h \
     utf8tab.h \
diff --git a/expat/lib/expat.h b/expat/lib/expat.h
index e2020a4..2b47ce2 100644
--- a/expat/lib/expat.h
+++ b/expat/lib/expat.h
@@ -1055,7 +1055,7 @@
 */
 #define XML_MAJOR_VERSION 2
 #define XML_MINOR_VERSION 4
-#define XML_MICRO_VERSION 8
+#define XML_MICRO_VERSION 9
 
 #ifdef __cplusplus
 }
diff --git a/expat/lib/internal.h b/expat/lib/internal.h
index 444eba0..e09f533 100644
--- a/expat/lib/internal.h
+++ b/expat/lib/internal.h
@@ -28,7 +28,7 @@
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2003      Greg Stein <gstein@users.sourceforge.net>
-   Copyright (c) 2016-2021 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Licensed under the MIT license:
@@ -107,7 +107,9 @@
 
 #include <limits.h> // ULONG_MAX
 
-#if defined(_WIN32) && ! defined(__USE_MINGW_ANSI_STDIO)
+#if defined(_WIN32)                                                            \
+    && (! defined(__USE_MINGW_ANSI_STDIO)                                      \
+        || (1 - __USE_MINGW_ANSI_STDIO - 1 == 0))
 #  define EXPAT_FMT_ULL(midpart) "%" midpart "I64u"
 #  if defined(_WIN64) // Note: modifiers "td" and "zu" do not work for MinGW
 #    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "I64d"
diff --git a/expat/lib/libexpat.def b/expat/lib/libexpat.def.cmake
similarity index 90%
rename from expat/lib/libexpat.def
rename to expat/lib/libexpat.def.cmake
index 5aebbd0..cf434a2 100644
--- a/expat/lib/libexpat.def
+++ b/expat/lib/libexpat.def.cmake
@@ -1,6 +1,5 @@
 ; DEF file for MS VC++
 
-LIBRARY
 EXPORTS
   XML_DefaultCurrent @1
   XML_ErrorString @2
@@ -72,9 +71,9 @@
   XML_ResumeParser @64
   XML_GetParsingStatus @65
 ; added with version 2.1.1
-; XML_GetAttributeInfo @66
+@_EXPAT_COMMENT_ATTR_INFO@ XML_GetAttributeInfo @66
   XML_SetHashSalt @67
 ; internal @68 removed with version 2.3.1
 ; added with version 2.4.0
-  XML_SetBillionLaughsAttackProtectionActivationThreshold @69
-  XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
+@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69
+@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
diff --git a/expat/lib/libexpatw.def b/expat/lib/libexpatw.def
deleted file mode 100644
index 5aebbd0..0000000
--- a/expat/lib/libexpatw.def
+++ /dev/null
@@ -1,80 +0,0 @@
-; DEF file for MS VC++
-
-LIBRARY
-EXPORTS
-  XML_DefaultCurrent @1
-  XML_ErrorString @2
-  XML_ExpatVersion @3
-  XML_ExpatVersionInfo @4
-  XML_ExternalEntityParserCreate @5
-  XML_GetBase @6
-  XML_GetBuffer @7
-  XML_GetCurrentByteCount @8
-  XML_GetCurrentByteIndex @9
-  XML_GetCurrentColumnNumber @10
-  XML_GetCurrentLineNumber @11
-  XML_GetErrorCode @12
-  XML_GetIdAttributeIndex @13
-  XML_GetInputContext @14
-  XML_GetSpecifiedAttributeCount @15
-  XML_Parse @16
-  XML_ParseBuffer @17
-  XML_ParserCreate @18
-  XML_ParserCreateNS @19
-  XML_ParserCreate_MM @20
-  XML_ParserFree @21
-  XML_SetAttlistDeclHandler @22
-  XML_SetBase @23
-  XML_SetCdataSectionHandler @24
-  XML_SetCharacterDataHandler @25
-  XML_SetCommentHandler @26
-  XML_SetDefaultHandler @27
-  XML_SetDefaultHandlerExpand @28
-  XML_SetDoctypeDeclHandler @29
-  XML_SetElementDeclHandler @30
-  XML_SetElementHandler @31
-  XML_SetEncoding @32
-  XML_SetEndCdataSectionHandler @33
-  XML_SetEndDoctypeDeclHandler @34
-  XML_SetEndElementHandler @35
-  XML_SetEndNamespaceDeclHandler @36
-  XML_SetEntityDeclHandler @37
-  XML_SetExternalEntityRefHandler @38
-  XML_SetExternalEntityRefHandlerArg @39
-  XML_SetNamespaceDeclHandler @40
-  XML_SetNotStandaloneHandler @41
-  XML_SetNotationDeclHandler @42
-  XML_SetParamEntityParsing @43
-  XML_SetProcessingInstructionHandler @44
-  XML_SetReturnNSTriplet @45
-  XML_SetStartCdataSectionHandler @46
-  XML_SetStartDoctypeDeclHandler @47
-  XML_SetStartElementHandler @48
-  XML_SetStartNamespaceDeclHandler @49
-  XML_SetUnknownEncodingHandler @50
-  XML_SetUnparsedEntityDeclHandler @51
-  XML_SetUserData @52
-  XML_SetXmlDeclHandler @53
-  XML_UseParserAsHandlerArg @54
-; added with version 1.95.3
-  XML_ParserReset @55
-  XML_SetSkippedEntityHandler @56
-; added with version 1.95.5
-  XML_GetFeatureList @57
-  XML_UseForeignDTD @58
-; added with version 1.95.6
-  XML_FreeContentModel @59
-  XML_MemMalloc @60
-  XML_MemRealloc @61
-  XML_MemFree @62
-; added with version 1.95.8
-  XML_StopParser @63
-  XML_ResumeParser @64
-  XML_GetParsingStatus @65
-; added with version 2.1.1
-; XML_GetAttributeInfo @66
-  XML_SetHashSalt @67
-; internal @68 removed with version 2.3.1
-; added with version 2.4.0
-  XML_SetBillionLaughsAttackProtectionActivationThreshold @69
-  XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
diff --git a/expat/lib/siphash.h b/expat/lib/siphash.h
index e5406d7..303283a 100644
--- a/expat/lib/siphash.h
+++ b/expat/lib/siphash.h
@@ -106,7 +106,7 @@
  * if this code is included and compiled as C++; related GCC warning is:
  * warning: use of C++11 long long integer constant [-Wlong-long]
  */
-#define _SIP_ULL(high, low) (((uint64_t)high << 32) | low)
+#define _SIP_ULL(high, low) ((((uint64_t)high) << 32) | (low))
 
 #define SIP_ROTL(x, b) (uint64_t)(((x) << (b)) | ((x) >> (64 - (b))))
 
diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index e986156..c0bece5 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -1,4 +1,4 @@
-/* 2722de33b8d95adcfb16db05afdec6ed1d40d51565cda2176c61806b5350eafe (2.4.8+)
+/* 90815a2b2c80c03b2b889fe1d427bb2b9e3282aa065e42784e001db4f23de324 (2.4.9+)
                             __  __            _
                          ___\ \/ /_ __   __ _| |_
                         / _ \\  /| '_ \ / _` | __|
@@ -19,7 +19,7 @@
    Copyright (c) 2016      Gustavo Grieco <gustavo.grieco@imag.fr>
    Copyright (c) 2016      Pascal Cuoq <cuoq@trust-in-soft.com>
    Copyright (c) 2016      Ed Schouten <ed@nuxi.nl>
-   Copyright (c) 2017-2018 Rhodri James <rhodri@wildebeest.org.uk>
+   Copyright (c) 2017-2022 Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2017      Václav Slavík <vaclav@slavik.io>
    Copyright (c) 2017      Viktor Szakats <commit@vsz.me>
    Copyright (c) 2017      Chanho Park <chanho61.park@samsung.com>
@@ -4271,7 +4271,7 @@
   const XML_Char *storedEncName = NULL;
   const ENCODING *newEncoding = NULL;
   const char *version = NULL;
-  const char *versionend;
+  const char *versionend = NULL;
   const XML_Char *storedversion = NULL;
   int standalone = -1;
 
@@ -5826,10 +5826,15 @@
   {
     parser->m_processor = contentProcessor;
     /* see externalEntityContentProcessor vs contentProcessor */
-    return doContent(parser, parser->m_parentParser ? 1 : 0, parser->m_encoding,
-                     s, end, nextPtr,
-                     (XML_Bool)! parser->m_parsingStatus.finalBuffer,
-                     XML_ACCOUNT_DIRECT);
+    result = doContent(parser, parser->m_parentParser ? 1 : 0,
+                       parser->m_encoding, s, end, nextPtr,
+                       (XML_Bool)! parser->m_parsingStatus.finalBuffer,
+                       XML_ACCOUNT_DIRECT);
+    if (result == XML_ERROR_NONE) {
+      if (! storeRawNames(parser))
+        return XML_ERROR_NO_MEMORY;
+    }
+    return result;
   }
 }
 
diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c
index c659983..2b7012a 100644
--- a/expat/lib/xmltok.c
+++ b/expat/lib/xmltok.c
@@ -21,6 +21,7 @@
    Copyright (c) 2017      José Gutiérrez de la Concha <jose@zeroc.com>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2021      Dong-hee Na <donghee.na@python.org>
+   Copyright (c) 2022      Martin Ettl <ettl.martin78@googlemail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -296,7 +297,7 @@
 }
 #else
 /* c is an ASCII character */
-#  define CHAR_MATCHES(enc, p, c) (*(p) == c)
+#  define CHAR_MATCHES(enc, p, c) (*(p) == (c))
 #endif
 
 #define PREFIX(ident) normal_##ident
@@ -740,7 +741,7 @@
   ((p)[1] == 0 ? ((struct normal_encoding *)(enc))->type[(unsigned char)*(p)]  \
                : unicode_byte_type((p)[1], (p)[0]))
 #define LITTLE2_BYTE_TO_ASCII(p) ((p)[1] == 0 ? (p)[0] : -1)
-#define LITTLE2_CHAR_MATCHES(p, c) ((p)[1] == 0 && (p)[0] == c)
+#define LITTLE2_CHAR_MATCHES(p, c) ((p)[1] == 0 && (p)[0] == (c))
 #define LITTLE2_IS_NAME_CHAR_MINBPC(p)                                         \
   UCS2_GET_NAMING(namePages, (unsigned char)p[1], (unsigned char)p[0])
 #define LITTLE2_IS_NMSTRT_CHAR_MINBPC(p)                                       \
@@ -875,7 +876,7 @@
        ? ((struct normal_encoding *)(enc))->type[(unsigned char)(p)[1]]        \
        : unicode_byte_type((p)[0], (p)[1]))
 #define BIG2_BYTE_TO_ASCII(p) ((p)[0] == 0 ? (p)[1] : -1)
-#define BIG2_CHAR_MATCHES(p, c) ((p)[0] == 0 && (p)[1] == c)
+#define BIG2_CHAR_MATCHES(p, c) ((p)[0] == 0 && (p)[1] == (c))
 #define BIG2_IS_NAME_CHAR_MINBPC(p)                                            \
   UCS2_GET_NAMING(namePages, (unsigned char)p[0], (unsigned char)p[1])
 #define BIG2_IS_NMSTRT_CHAR_MINBPC(p)                                          \
diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
index 4072b06..1971d74 100644
--- a/expat/lib/xmltok_impl.c
+++ b/expat/lib/xmltok_impl.c
@@ -16,6 +16,7 @@
    Copyright (c) 2018      Anton Maklakov <antmak.pub@gmail.com>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2020      Boris Kolpackov <boris@codesynthesis.com>
+   Copyright (c) 2022      Martin Ettl <ettl.martin78@googlemail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -96,7 +97,7 @@
 
 #  define CHECK_NMSTRT_CASE(n, enc, ptr, end, nextTokPtr)                      \
   case BT_LEAD##n:                                                             \
-    if (end - ptr < n)                                                         \
+    if ((end) - (ptr) < (n))                                                   \
       return XML_TOK_PARTIAL_CHAR;                                             \
     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NMSTRT_CHAR(enc, ptr, n)) {       \
       *nextTokPtr = ptr;                                                       \
@@ -124,7 +125,8 @@
 #    define PREFIX(ident) ident
 #  endif
 
-#  define HAS_CHARS(enc, ptr, end, count) (end - ptr >= count * MINBPC(enc))
+#  define HAS_CHARS(enc, ptr, end, count)                                      \
+    ((end) - (ptr) >= ((count)*MINBPC(enc)))
 
 #  define HAS_CHAR(enc, ptr, end) HAS_CHARS(enc, ptr, end, 1)
 
diff --git a/expat/qa.sh b/expat/qa.sh
index 0794777..525deb3 100755
--- a/expat/qa.sh
+++ b/expat/qa.sh
@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2016-2021 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2019      Philippe Antoine <contact@catenacyber.fr>
 # Copyright (c) 2019      Hanno Böck <hanno@gentoo.org>
 # Licensed under the MIT license:
@@ -154,14 +154,14 @@
     esac
 
     if [[ ${CC} =~ mingw ]]; then
-        # NOTE: Filenames are hardcoded for Travis' Ubuntu Bionic, as of now
         for i in tests xmlwf ; do
-            mingw32_dir="$(ls -1d /usr/lib/gcc/i686-w64-mingw32/* | head -n1)"
+            mingw32_dir="$(dirname "$(ls -1 /usr/lib*/gcc/i686-w64-mingw32/*/{libgcc_s_sjlj-1.dll,libstdc++-6.dll} | head -n1)")"
             RUN ln -s \
                     /usr/i686-w64-mingw32/lib/libwinpthread-1.dll \
+                    "${mingw32_dir}"/libgcc_s_dw2-1.dll \
                     "${mingw32_dir}"/libgcc_s_sjlj-1.dll \
                     "${mingw32_dir}"/libstdc++-6.dll \
-                    "$PWD"/libexpat{,w}.dll \
+                    "$PWD"/libexpat{,w}-*.dll \
                     ${i}/
         done
     fi
diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c
index ea371b4..530f184 100644
--- a/expat/tests/runtests.c
+++ b/expat/tests/runtests.c
@@ -4990,6 +4990,78 @@
 }
 END_TEST
 
+void
+suspending_comment_handler(void *userData, const XML_Char *data) {
+  UNUSED_P(data);
+  XML_Parser parser = (XML_Parser)userData;
+  XML_StopParser(parser, XML_TRUE);
+}
+
+START_TEST(test_suspend_resume_internal_entity_issue_629) {
+  const char *const text
+      = "<!DOCTYPE a [<!ENTITY e '<!--COMMENT-->a'>]><a>&e;<b>\n"
+        "<"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        "/>"
+        "</b></a>";
+  const size_t firstChunkSizeBytes = 54;
+
+  XML_Parser parser = XML_ParserCreate(NULL);
+  XML_SetUserData(parser, parser);
+  XML_SetCommentHandler(parser, suspending_comment_handler);
+
+  if (XML_Parse(parser, text, (int)firstChunkSizeBytes, XML_FALSE)
+      != XML_STATUS_SUSPENDED)
+    xml_failure(parser);
+  if (XML_ResumeParser(parser) != XML_STATUS_OK)
+    xml_failure(parser);
+  if (XML_Parse(parser, text + firstChunkSizeBytes,
+                (int)(strlen(text) - firstChunkSizeBytes), XML_TRUE)
+      != XML_STATUS_OK)
+    xml_failure(parser);
+  XML_ParserFree(parser);
+}
+END_TEST
+
 /* Test syntax error is caught at parse resumption */
 START_TEST(test_resume_entity_with_syntax_error) {
   const char *text = "<!DOCTYPE doc [\n"
@@ -7589,7 +7661,7 @@
     fail("Version mismatch");
 
 #if ! defined(XML_UNICODE) || defined(XML_UNICODE_WCHAR_T)
-  if (xcstrcmp(version_text, XCS("expat_2.4.8"))) /* needs bump on releases */
+  if (xcstrcmp(version_text, XCS("expat_2.4.9"))) /* needs bump on releases */
     fail("XML_*_VERSION in expat.h out of sync?\n");
 #else
   /* If we have XML_UNICODE defined but not XML_UNICODE_WCHAR_T
@@ -11764,12 +11836,12 @@
 END_TEST
 
 static float
-portableNAN() {
+portableNAN(void) {
   return strtof("nan", NULL);
 }
 
 static float
-portableINFINITY() {
+portableINFINITY(void) {
   return strtof("infinity", NULL);
 }
 
@@ -12016,6 +12088,8 @@
   tcase_add_test(tc_basic, test_partial_char_in_epilog);
   tcase_add_test(tc_basic, test_hash_collision);
   tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_internal_entity);
+  tcase_add_test__ifdef_xml_dtd(tc_basic,
+                                test_suspend_resume_internal_entity_issue_629);
   tcase_add_test__ifdef_xml_dtd(tc_basic, test_resume_entity_with_syntax_error);
   tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_parameter_entity);
   tcase_add_test(tc_basic, test_restart_on_error);
diff --git a/expat/win32/build_expat_iss.bat b/expat/win32/build_expat_iss.bat
index 2e2d6fd..53e4351 100644
--- a/expat/win32/build_expat_iss.bat
+++ b/expat/win32/build_expat_iss.bat
@@ -7,7 +7,7 @@
 REM                      \___/_/\_\ .__/ \__,_|\__|
 REM                               |_| XML parser
 REM
-REM Copyright (c) 2019 Sebastian Pipping <sebastian@pipping.org>
+REM Copyright (c) 2019-2021 Sebastian Pipping <sebastian@pipping.org>
 REM Licensed under the MIT license:
 REM
 REM Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -43,7 +43,7 @@
 
 MD build_shared_char || EXIT /b 1
 CD build_shared_char || EXIT /b 1
-    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_BUILD_TOOLS=OFF .. || EXIT /b 1
+    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_WARNINGS_AS_ERRORS=ON -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_BUILD_TOOLS=OFF .. || EXIT /b 1
     msbuild /m expat.sln || EXIT /b 1
     DIR %CONFIGURATION% || EXIT /b 1
     CD .. || EXIT /b 1
@@ -53,7 +53,7 @@
 
 MD build_static_char || EXIT /b 1
 CD build_static_char || EXIT /b 1
-    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_SHARED_LIBS=OFF .. || EXIT /b 1
+    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_WARNINGS_AS_ERRORS=ON -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_SHARED_LIBS=OFF .. || EXIT /b 1
     msbuild /m expat.sln || EXIT /b 1
     DIR %CONFIGURATION% || EXIT /b 1
     CD .. || EXIT /b 1
@@ -63,7 +63,7 @@
 
 MD build_shared_wchar_t || EXIT /b 1
 CD build_shared_wchar_t || EXIT /b 1
-    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_BUILD_TOOLS=OFF -DEXPAT_CHAR_TYPE=wchar_t .. || EXIT /b 1
+    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_WARNINGS_AS_ERRORS=ON -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_BUILD_TOOLS=OFF -DEXPAT_CHAR_TYPE=wchar_t .. || EXIT /b 1
     msbuild /m expat.sln || EXIT /b 1
     DIR %CONFIGURATION% || EXIT /b 1
     CD .. || EXIT /b 1
@@ -73,7 +73,7 @@
 
 MD build_static_wchar_t || EXIT /b 1
 CD build_static_wchar_t || EXIT /b 1
-    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_BUILD_TOOLS=OFF -DEXPAT_SHARED_LIBS=OFF -DEXPAT_CHAR_TYPE=wchar_t .. || EXIT /b 1
+    cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_WARNINGS_AS_ERRORS=ON -DEXPAT_MSVC_STATIC_CRT=ON -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_BUILD_TOOLS=OFF -DEXPAT_SHARED_LIBS=OFF -DEXPAT_CHAR_TYPE=wchar_t .. || EXIT /b 1
     msbuild /m expat.sln || EXIT /b 1
     DIR %CONFIGURATION% || EXIT /b 1
     CD .. || EXIT /b 1
diff --git a/expat/win32/expat.iss b/expat/win32/expat.iss
index 0cbfbc7..5b234ec 100644
--- a/expat/win32/expat.iss
+++ b/expat/win32/expat.iss
@@ -37,7 +37,7 @@
 ; OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 ; USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-#define expatVer "2.4.8"
+#define expatVer "2.4.9"
 
 [Setup]
 AppName=Expat
@@ -91,7 +91,7 @@
 Flags: ignoreversion; Source: fuzz\*.c;                     DestDir: "{app}\Source\fuzz"
 Flags: ignoreversion; Source: lib\*.c;                      DestDir: "{app}\Source\lib"
 Flags: ignoreversion; Source: lib\*.h;                      DestDir: "{app}\Source\lib"
-Flags: ignoreversion; Source: lib\*.def;                    DestDir: "{app}\Source\lib"
+Flags: ignoreversion; Source: lib\*.def.cmake;              DestDir: "{app}\Source\lib"
 Flags: ignoreversion; Source: examples\*.c;                 DestDir: "{app}\Source\examples"
 Flags: ignoreversion; Source: tests\*.c;                    DestDir: "{app}\Source\tests"
 Flags: ignoreversion; Source: tests\*.cpp;                  DestDir: "{app}\Source\tests"
diff --git a/expat/xmlwf/win32filemap.c b/expat/xmlwf/win32filemap.c
index bde4777..a2db8ea 100644
--- a/expat/xmlwf/win32filemap.c
+++ b/expat/xmlwf/win32filemap.c
@@ -9,7 +9,8 @@
    Copyright (c) 1997-2000 Thai Open Source Software Center Ltd
    Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
    Copyright (c) 2002      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
-   Copyright (c) 2016-2017 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2022      Martin Ettl <ettl.martin78@googlemail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -107,7 +108,7 @@
 
 static void
 win32perror(const TCHAR *s) {
-  LPVOID buf;
+  LPVOID buf = NULL;
   if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
                     NULL, GetLastError(),
                     MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&buf, 0,
diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
index b0cd212..471f2a2 100644
--- a/expat/xmlwf/xmlwf.c
+++ b/expat/xmlwf/xmlwf.c
@@ -17,6 +17,7 @@
    Copyright (c) 2020      Joe Orton <jorton@redhat.com>
    Copyright (c) 2020      Kleber Tarcísio <klebertarcisio@yahoo.com.br>
    Copyright (c) 2021      Tim Bray <tbray@textuality.com>
+   Copyright (c) 2022      Martin Ettl <ettl.martin78@googlemail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -217,7 +218,7 @@
   const XML_Char *att1 = *(const XML_Char **)p1;
   const XML_Char *att2 = *(const XML_Char **)p2;
   int sep1 = (tcsrchr(att1, NSSEP) != 0);
-  int sep2 = (tcsrchr(att1, NSSEP) != 0);
+  int sep2 = (tcsrchr(att2, NSSEP) != 0);
   if (sep1 != sep2)
     return sep1 - sep2;
   return tcscmp(att1, att2);