use upstream patches for the XML CVE