This is a security release. People running 7.x-2.0-alpha8 or below should update. This release only contains security fixes, no additional bug fixes or features.
Changes since 7.x-2.0-alpha8:
#2495145 by twistor, cashwilliams, greggles, klausi: Possible XSS in PuSHSubscriber.inc
#2502419 by klausi: Log messages XSS attack vector
#1848498 by twistor: Respect allowed file extensions in file mapper