The security advisory that came out today referred to a set of issues, all of which appear to have been fixed by 4.4.20 if present in the 4.4.X version at all. I don't see any separate patch notes / changelog anywhere for 4.4.21, other than the standard "a variety of non-security issues" language.
So, does anyone know what ACTUALLY changed in 4.4.21?
This was asked on IRC last week, see https://irc.civicrm.org/logs/%23civicrm.log.2016-02-04.txt :
[09:16] <bails> Hi all, slight confusion here: Is 4.6.12 / 4.4.21 a security release?
[09:18] <bails> I ask as https://civicrm.org/advisory says 4.6.11 but thast was released 2016-01-06 rather than yesterday and we didn't get any emails saying a security release was released...
[09:33] <yashodha> bails: some of the security issues were fixed in 4.6.11 but we somehow ended up not tagging it as a security release - hence all we did a security release which includes all the security fixes in the previous version as well
[09:34] <bails> Hi Yashoda, so 4.6.12 is a security release, but has other security patches not in 4.6.11?
[09:41] <yashodha> bails: all the 3 security patches are already in 4.6.11
So my impression is that 4.4.20 and 4.6.11 were actually the security releases but weren't tagged as such; 4.4.21 and 4.6.12 were then tagged as security releases so that people would be prompted to upgrade.
https://github.com/civicrm/civicrm-core/compare/4.4.20...4.4.21
Nothing that looks security-sensitive to me. Are the three 2016 flaws also present in 4.4.20/4.4.21?
I guess one way would be to look at the commits on 4.4 in between "Update version to 4.4.20" and "Update version to 4.4.21":
