Although this branch is marked unsupported, I thought it would be important to release this update for the 5.x version as well. A cross site scripting issue was resolved with the commit message:
Backported fix for XSS reported by Psicomante. Strings output for JavaScript display were not escaped properly. Due to how the Drupal.org policy limits security announcements to 'stable' software (that is not alpha packages like l10n_server), this fix is not accompanied by an SA.