Security Fixes

• Fixed Lua being able to escape sandboxing via load/loadstring (CVE-2018-1999023).

Add-ons server

• Made it so plain-text .po catalogues in add-ons are detected and added to the list of translations for them.

Campaigns

• Dead Water:
  • In 'Tirigaz', take the situation into account of orcs being killed either first or by undead.

• Delfador's Memoirs:
  • Fix hero units costing upkeep (issue #3722)

• Eastern Invasion:
  • Fixed missing prisoners and loss of recallable units in 'Captured'.

• Northern Rebirth:
  • Level 0 units are not available anymore after scenario 5

• Secrets of the Ancients:
  • Adjust gender of enemies to better match story in S11 & 21 (issue #3294)
  • Simplify dialog to fix possible confusion in S16 (issue #3291)
  • Have nagas be able to recruit in S21 (issue #3293)

• The South Guard:
  • S4: undead leader won't leave the castle anymore
  • S5: the untypical situation that one can defeat the lich before finding Urza Afalas is now handled

• Under the Burning Suns:
  • S11: added custom graphics for the citadel.
  • S12: clarified the alien bodies' weaknesses.
  • Various visual improvements.

Editor

• Fixed saving a map as a scenario not enabling scenario editor tools.

Graphics

• New attack animation for the Peasant.
• Tweaked the Ruffian's attack animation timing.

Language and i18n

• Updated translations: British English, Bulgarian, Chinese (Simplified), Chinese (Traditional), Czech, French, German, Hungarian, Japanese, Scottish Gaelic, Slovak, Spanish

Lua API

• Upgrade to Lua 5.3.5.

Multiplayer server

• Fixed lobby and whisper messages not having a maximum length.

User interface

• Improved the layout of the Statistics dialog.
• Allow changing dropdown menu selections with the scrollwheel (FR #3251).
• Fixed lobby chat box scrolling to top on a new message if it isn't at the bottom (issue #2789).
• Fixed the unit preview pane not showing the default race icon when detailing a single unit's stats.
• Sort units secondarily by XP in the unit list dialog.
• Whiteboard related bugfixes

WML engine

• Fixed errors about WESNOTH_VERSION not being defined when trying to load add-ons that have preprocessor errors (issues #1924, #1634).

Miscellaneous and bug fixes

• Added an advanced preference to enable experimental PRNG combat.
• Campfires use illumination instead of a different ToD.
• Linux builds now enable security hardening by default.
• Fixed MP admins being unable to observe private games.
• Fixed MP faction, leader, and leader gender changes persisting even if the selection dialog is dismissed.
• Fixed an issue with positioned sound sources ignoring the volume set in Preferences after going off the audible radius and back (issue #3280).
• Fixed wmllint choking on gzipped binary files (e.g. gzipped tarballs).
• Fixed wmllint crashing on nonexistent paths provided in the command line (issue #3286).
• Slight changes to the objectives dialogue (pr #3309)
• Greatly improved touch control support.
• Fixed wmlindent crashing on nonexistent paths provided in the command line (issue #3346).