backported security changes