I've signed and uploaded a test build of 3.2.5: https://dist.apache.org/repos/dist/dev/xerces/c/3/sources/
Only real work done is Boris' changes to fix the open CVE and add the SAX option to disable DTDs. Windows has not yet been tested. The site material should be updated, including an update to the 2018 advisory noting it is fixed in 3.2.5. If Windows builds, this would be the candidate to vote out. -- Scott
