diff --git a/CHANGELOG.md b/CHANGELOG.md
index 078ad145..f27c07e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## [7.2.1]
+
+- correctly handle favicons hosted at the root of the domain for feeds with non-default ports
+- prevent XXS injections in third party apps. The CommaFeed React client was already stripping malicious "javascript:" URLs, they are now filtered during feed parsing and no longer stored in the database/served through the REST API.
+
 ## [7.2.0]
 
 - Add support for icons declared in feeds. This is useful for feeds exposed by RSS bridges (#2048)
diff --git a/commafeed-client/pom.xml b/commafeed-client/pom.xml
index 3d6d311b..7cf779ab 100644
--- a/commafeed-client/pom.xml
+++ b/commafeed-client/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>7.2.0</version>
+		<version>7.2.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>
diff --git a/commafeed-server/pom.xml b/commafeed-server/pom.xml
index e8ebbf05..74d77814 100644
--- a/commafeed-server/pom.xml
+++ b/commafeed-server/pom.xml
@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.commafeed</groupId>
         <artifactId>commafeed</artifactId>
-        <version>7.2.0</version>
+        <version>7.2.1</version>
     </parent>
     <artifactId>commafeed-server</artifactId>
     <name>CommaFeed Server</name>
@@ -302,7 +302,7 @@
         <dependency>
             <groupId>com.commafeed</groupId>
             <artifactId>commafeed-client</artifactId>
-            <version>7.2.0</version>
+            <version>7.2.1</version>
         </dependency>
 
         <!-- compile-time processors -->
diff --git a/pom.xml b/pom.xml
index f95935cf..9474ec51 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
 
 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>7.2.0</version>
+	<version>7.2.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>