Late last week the Drupal community released, in quick succession, Drupal 5.13 and Drupal 5.14. The first release was a critical security release aimed at preventing cross-site scripting (see the advisory for more information), and the second release was to fix a regression (a bug, not a security issue) introduced by that security fix. We're taking the opportunity to update a few modules as well: CCK is updated to 1.10, Google Analytics is updated to 1.7, Image Assist is updated to 1.7, and the Mollom spam-fighting module is updated to 1.6. We've also contributed the update we made to the Watchdog hook backport patch to the community.

The tag for today's release is 2008-12-16s. We recommend that you backup your databases before upgrading, then proceed to using our instructions on how to upgrade the VPS installations of Drupal to the latest tag.

A few people have noticed on their sites that Google Analytics is no longer tracking users, or rather, it's not tracking all visits to the site. We recently upgraded the Google Analytics module to the latest official release, which added some features as well as permissions. To restore tracking, you may need to update your site's settings:

1. go to Administer » User management » Access control and give your role the "administer google analytics" permission.
2. then go to Administer » Site configuration » Google Analytics, and set which roles you want to track. If you want to track non-logged-in visitors to your site, make sure you include the "anonymous user" role.

We updated our documentation on statistics tracking as well to reflect the changes in the module.