What’s added/changed in this version

The vulnerabilities are

Low Risk: A XSS vulnerability related to post icons - reported by Destroy666
Low Risk: A XSS vulnerability in admin/modules/style/templates.php
Low Risk: A XSS vulnerability in admin/modules/config/languages.php
Low Risk: unserialize may call magic methods - reported by chtg
Low Risk: request_order can break register globals handling - reported by chtg

Additionally we’ve revised the handling of data fetched from our website as a direct consequence of the compromised GitHub account (#1617). In addition to that, we’ve set the adminsid cookie as httpOnly - #1622.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.