Update to 2.6.1, backport fix for CVE-2024-28757.

Source: Fedora 38: mingw-expat 2024-40b98c9ced