the following changes have been pushed to bugzilla.mozilla.org:
-  Outdated FreeOTP link in user preferences
-  Add index to email_rates.message_ts
-  Exempt bot accounts from idle group removal
-  Update policy code in BMO PhabBugz extension to update custom policy if a private bugs groups have changed.
-  Migrate secbugstats scripts to bmo production
-  Refactor Project.pm to use Moo for better type checking
-  Refactor Revision.pm to use Moo for cleaner type checking
-  securemail help page recommends getting a certificate from StartCom
-  Prevent cross-site image requests from leaking contents of certain fields due to regex search
-  Add script to add email job to jobqueue
-  needinfo from someone not in sec group shows warning message even when bug is being removed from sec group
-  Prevent bugzilla static assets from being blocked by overly long request URIs
discuss these changes on mozilla.tools.bmo.