3.8.1: the places the change-text fix missed (setting names), and why escaping alone would not fix the calendar filter
Security write-ups for 3.8.0: change text could run script; AI settings saved without the AI permission