Correct Microsoft security bulletin for ppr_flatten_rec
Land #4450, MSB reference fix
Merge remote-tracking branch 'upstream/master'