The bug tracking this for the next release cycle is here: https://issues.shibboleth.net/jira/browse/SSPCPP-392 Any patches there will be limited to fixes for leaks so anybody needing them urgently can build from source using them. They are unfortunately spread across all of the code bases (a couple in each one). -- Scott