[development] backporting sec patches