> So... is the 1.8.x branch currently secure, or insecure?
Apart from master it is the most secure branch we have.
> Using master isn't really an option as breaking changes land very often in SMW.
What kind of breaking changes are you talking about? From a user perspective there are very rarely changes that break existing usage. And master should not contain real broken code. Since we used to not have tests, not have CI and not have reviews at all as short as a year and a half ago, the later point used to not be respected as much as it is now.
We have a lot of people running master, including some that got some random revision and then did not update for a long time: http://wikiapiary.com/wiki/Extension:Semantic_MediaWiki
Jeroen De Dauwhttp://www.bn2vs.com
Don't panic. Don't be evil.