diff --git a/expat/Changes b/expat/Changes
index db5f7f32..d6385238 100644
--- a/expat/Changes
+++ b/expat/Changes
@@ -1,3 +1,14 @@
+Release ??? ???
+        Security fixes:
+            #499: Use more entropy for hash initialization
+            #519: Resolve troublesome internal call to srand
+
+        Other changes:
+            #532: Fix compilation for Visual Studio 2010
+            p90: Fix static build (BUILD_shared=OFF) with CMake on Windows
+            Remove executable flag from source files
+            Address some compile warnings
+
 Release 2.1.1 Sat March 12 2016
         Security fixes:
             #582: CVE-2015-1283 - Multiple integer overflows in XML_GetBuffer
@@ -7,7 +18,7 @@ Release 2.1.1 Sat March 12 2016
             #520: Symbol XML_SetHashSalt was not exported
             Output of "xmlwf -h" was incomplete
 
-        Other changes
+        Other changes:
             #503: Document behavior of calling XML_SetHashSalt with salt 0
             Minor improvements to man page xmlwf(1)
             Improvements to the experimental CMake build system
diff --git a/htdocs/index.html b/htdocs/index.html
index 8a1630f0..bb3ac2ab 100644
--- a/htdocs/index.html
+++ b/htdocs/index.html
@@ -55,6 +55,27 @@ of Expat.</p>
 <h3 id="news">News</h3>
 
 <dl>
+  <dt><em>???</em>,
+      Expat ??? released.
+    </dt>
+  <dd><p>Release ??? includes security &amp; other bug fixes.</p>
+    <h4>Security fixes</h4>
+    <ul>
+      <li>Use more entropy for hash initialization
+        (<a href="https://sourceforge.net/p/expat/bugs/499/">bug 499</a>)</li>
+      <li>Resolve troublesome internal call to srand
+        (<a href="https://sourceforge.net/p/expat/bugs/519/">bug 519</a>)</li>
+    </ul>
+    <h4>Other changes</h4>
+    <ul>
+      <li>Fix compilation for Visual Studio 2010
+        (<a href="https://sourceforge.net/p/expat/bugs/532/">bug 532</a>)</li>
+      <li>Fix static build (<code>BUILD_shared=OFF</code>) with CMake on Windows
+        (<a href="https://sourceforge.net/p/expat/patches/90/">patch 90</a>)</li>
+      <li>Remove executable flag from source files</li>
+      <li>Address some compile warnings</li>
+    <ul>
+  </dd>
   <dt><em>12 March 2016</em>,
       Expat 2.1.1 released.
     </dt>