Merge branch 'security-fixes' into fixes