"Bug fixes and general improvements."
Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.