[security] multi_xml, rack mandatory updates