This release fixes two denial-of-service bugs:

• CVE-2019-11937 in the carbon protocol reader
• CVE-2019-11923 in the deprecated ASCII parser.