core security and contrib updates