Brief update on 2.5.4 SP patch

[Cantor, Scott]

Just a short update on where things stand. My bug fixes are essentially 
done at this point, and I'm now waiting on external timelines.

One is the Xerces 3.1.2 release. I am now stuck handling bug fixes for 
that project too, and the only way to get a bug fix release done (the 
first in years) was for me to force it, so I did the work. I published a 
beta last night and announced it earlier today, and it's scheduled to be 
released next week if nothing comes up.

That is the main gating factor to get the SP release done.

I also need to start the release machinery for an xml-security library 
update but I have more control over that process and that's been ready to 
get done for a couple of weeks, so I'll be publishing a beta tonight and 
probably releasing early next week.

Once Xerces is officially released, I'll be releasing the SP update 
immediately after, so end of next week is likely.

A possible complicating factor is whether this latest set of TLS 
vulnerabilities end up causing an OpenSSL patch, but as long as they 
release it soon, it won't be a problem.

-- Scott