Henri pulled the 2.3 release due to licensing problems (mail.jar and activation.jar). We've got a replacement (2.3.1) that removes those jars, incorporates a couple of security fixes and that has been tested. The vote bogged down in the early fall and we never resumed it.
Now that we can vote on our own releases, shall we vote this one out? Files are here: http://people.apache.org/~snoopdave/apache-roller-2.3.1/ - Dave