Many thanks for that info, Jess & Peter. Am I right in thinking that 2.9 and 2.9.1 haven't needed to address any security issues, so until 2.9.x is released to address security, the latest "security release", 2.8.6 is still safe?