I like the change; maybe worth mentioning why we are deprecating it?

Do we have data about how much difference in size would this cause? (for example, is DVD / cost for network bandwidth still a concern, or do we still have plenty of grow space? And should we use a higher compression level for zstd? The default for zstd was 3, IIRC, decompression speed / memory requirement won't increase so much until level 9, while compression ratio would be significantly better than default for highly compressible data).

I think code should be using groupmember(9) instead of rolling our own.

Reflect reviewer comments.

Looks reasonable.

I only looked into lib/{expat.h,internal.h,siphash.h,xmlparse.c} and these looks fine.

For libmd, please also remove the _Transform functions from the header (.h) files.

Could you please remove these _version symbols? They are not supposed to be used by consumers and should be made static or commented out in the source files.