security updates and bugfixes only

Just wondering: while this is less of an attack surface, it's still a surface?