Note that this release obsoletes the now abandoned 9.0.x branch which should no longer be used. Projects that somehow were requiring the 9.0.x-dev version of this module should now simply use ^4.0@beta instead.
New user's password set to weak password in _user_resource_create()
When creating a new user account via Services, the new user's password was set to a weak password.
This issue is mitigated by the fact that the user resource must be enabled (or least have been enabled in the past) and new user registration permitted via Services.