Users running a non-download version of Vanilla (pulled from github), on branch release/2019.016 or master from the last 2 weeks should upgrade to release/2019.017 or latest master for security reasons. Downloaded official open sources releases are not affected.
CLEditor .js duplication
This plugin could probably be cleaned up, there's duiplicates of both jquery.cleditor.js and jquery.cleditor.min.js in the plugin directory and in the js/ subdirectory, the similarly named files are not the same. Only the .min.js in js/ get's used so why even include the others.