New versions have been announced for Drupal 6 and 7, which include only security-related changes, one of them allowing a potential attacker to reset a user’s account without the need of a password.