backported security fix, hardcoded version #