HTML Purifier 4.9.x is a maintenance release, collecting a year of accumulated bug fixes plus a few new features. New features include support for min/max-width/height CSS, and rgba/hsl/hsla in color specifications. Major bugfixes include improvements in the Serializer cache to avoid chmod'ing directories, better entity decoding (we won't accidentally encode entities that occur in URLs) and rel="noopener" on links with target attributes, to prevent them from overwriting the original frame. 4.9.3 works around an infinite loop bug in PHP 7.1 with the opcode cache (and has one other, minor bugfix, avoiding using autoloading when testing for DOMDocument presence). If these bugs do not affect you, you do not need to upgrade.