To fix security issues, or to introduce new features increasing the attack surface?