cmplayer: fix build
xen: note about security for next bump