I have the xmltooling change ready to release. But I can't rightly call it a security fix, it's just a hardening change to add a layer of defense. -- Scott