HTML Purifier 4.9.x is a maintenance release, collecting a year
of accumulated bug fixes plus a few new features.  New features
include support for min/max-width/height CSS, and rgba/hsl/hsla
in color specifications.  Major bugfixes include improvements
in the Serializer cache to avoid chmod'ing directories, better
entity decoding (we won't accidentally encode entities that occur
in URLs) and rel="noopener" on links with target attributes,
to prevent them from overwriting the original frame.

4.9.3 works around an infinite loop bug in PHP 7.1 with the opcode
cache (and has one other, minor bugfix, avoiding using autoloading
when testing for DOMDocument presence).  If these bugs do not
affect you, you do not need to upgrade.