tla is using bundled neon-0.24.7 and expat-1.95.8 to build. As already noticed once, this can become a security issue pretty easily (see Bug 51586). 1.2-r2 was patched to use external neon at least, but in 1.3.x the patch is lost. Hmmm...
removed from tree.