WordPress released there new version, which is 5.4.1. There have some optimization, below have change log:-

Security updates #Security updates

Six security issues affect WordPress versions 5.4 and earlier; version 5.4.1 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.

• Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated
• Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated
• Props to Evan Ricafort for discovering an XSS issue in the Customizer
• Props to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block
• Props to Nick Daugherty from WPVIP.com / WordPress Security Team who discovered an XSS issue in wp-object-cache
• Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.
• Additionally, an authenticated XSS issue in the block editor was discovered by Nguyen the Duc in WordPress 5.4 RC1 and RC2. It was fixed in 5.4 RC5. We wanted to be sure to give credit and thank them for all of their work in making WordPress more secure.

read more

• Important: iThemes Security requires PHP 5.6 or greater and WordPress 5.2 or greater.
• New Feature: Save Time Securing WordPress With User Groups!
• New Feature: Simplified connection flow when setting up iThemes Sync.
• Enhancement: Add a warning if a WordPress Salt is set to an invalid value.
• Enhancement: Include child log items in the logs list table. These are helpful for debugging issues.
• Enhancement: Improve performance of the logs page on sites with large number of log items.
• Enhancement: Check tables exist after completing a DB upgrade.
• Tweak: When logging $_SERVER, only log a snapshot of available properties.
• Bug Fix: The “Mulisite Tweaks -> Hide Updates” setting prevented auto-updates from running with WP Cron.
• Bug Fix: Backup event was not added when the WP Cron Scheduler was reset manually.
• Bug Fix: Admin Notices Popover was not being hidden when clicking outside the Popover on WP 5.3.
• Bug Fix: New Password Requirements for already created accounts were not enforced until the second login.
• Bug Fix: Update admin notices styling to be compatible with WordPress 5.4.
• Bug Fix: Periodically clear expired opaque tokens.
• Bug Fix: Don’t block registration page when “wp-signup.php” is the Hide Backend register slug.
• Bug Fix: Users with weak passwords would not be forced to change their password if the strong password requirement had been enabled after their password strength was checked.
• Bug Fix: Remove “get_magic_quotes()” call that existed for backwards compatibility with PHP versions 5.3 and earlier. This function call was causing a warning on PHP 7.4.
• Bug Fix: Warning when loading the settings page on PHP 7.4.
• Bug Fix: Warning when loading the debug page on PHP 7.4.

Credit: iTheme Security Plugin Page.