Merge 4.0.1

The security fixes from the `v4.0.1` tag seem to have not yet made it into the main `maint-4.0` branch, so this request takes care of that.