The 'Upgrading Elgg' page says:
It was required to replace the core files completely when switching from 1.8 to 1.9. But with the adoption of 'semver' (with version 1.10?), the minor update is now on the same level as what patch update was on 1.8. And with 1.8 patch updates we would just overwrite the core files.
So, is it still necessary to replace the core files with the current definition of minor update?
p.s. hope this is the right place for this question
Security issues should be reported to email@example.com!