"It must first reach a karma of 2, consisting of 0 positive karma from proventesters, along with 2 additional karma from the community."
 
While the update has a karma of 2, only one of those is from the community (the other being from proventesters). My understanding is that the policy requiring 2 karma from the community is currently what's keeping the update in testing.
 
I have seen many examples during the last year of security updates taking a very long time to get to users. Mozilla released this security fix on April 3rd -- here we are April 18th and it will likely be a few more days yet before the fix makes it to users of Fedora 20.
 
Sent: Saturday, April 18, 2015 at 9:49 PM
From: "Björn Persson" <Bjorn@rombobjörn.se>
To: packaging@lists.fedoraproject.org
Subject: Re: [Fedora-packaging] critical path security update policy
Jerry Bratton wrote:
> I'm concerned about how long it takes security updates to make it to
> users under Fedora's current policies (which generally allow such
> updates the possibility of sitting in testing for 14 days, or even
> longer).
>
> Just one example is the Firefox 37.0.1 update for Fedora 20:
> https://admin.fedoraproject.org/updates/FEDORA-2015-5723/firefox-37.0.1-1.fc20

Looking at your example I see that the requirement of karma >= 2 was
fulfilled a week ago. That it's still in testing is not because of
policy.

Björn Persson
--
packaging mailing list
packaging@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/packaging