expat: add v2.7.2 (fixes CVE-2025-59375) and v2.7.3 (spack#1517)

Author: hartwork

repos/spack_repo/builtin/packages/expat/package.py

@@ -18,8 +18,20 @@ class Expat(AutotoolsPackage, CMakePackage):
     url = "https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.bz2"
 
     license("MIT")
-    version("2.7.1", sha256="45c98ae1e9b5127325d25186cf8c511fa814078e9efeae7987a574b482b79b3d")
-    version("2.7.0", sha256="10f3e94896cd7f44de566cafa2e0e1f35e8df06d119b38d117c0e72d74a4b4b7")
+    version("2.7.3", sha256="59c31441fec9a66205307749eccfee551055f2d792f329f18d97099e919a3b2f")
+    version("2.7.2", sha256="976f6c2d358953c22398d64cd93790ba5abc62e02a1bbc204a3a264adea149b8")
+    # deprecate all releases before 2.7.2 because of security issues,
+    # the latest being https://nvd.nist.gov/vuln/detail/CVE-2025-59375
+    version(
+        "2.7.1",
+        sha256="45c98ae1e9b5127325d25186cf8c511fa814078e9efeae7987a574b482b79b3d",
+        deprecated=True,
+    )
+    version(
+        "2.7.0",
+        sha256="10f3e94896cd7f44de566cafa2e0e1f35e8df06d119b38d117c0e72d74a4b4b7",
+        deprecated=True,
+    )
 
     build_system("autotools", "cmake", default="autotools")