bump node-expat to ~2.0.0