This will be my first upgrade on Zen Cart and I'm just going to relay a comment about what I'm seeing.
I work with a number of other open source / CMS programs that also require regular security patches and upgrades.
After reading this post and the "readme_how_to_upgrade" (in the docs folder of 1.3.8)... I have to tell you... this is the most cumbersome upgrade/patch I've seen to-date. This looks like a fresh installation, not a patch.
In other open source apps, a patch is normally issued separately; containing only the affected files. With these apps, I never have to wipe out a database and reinstall it, or install a third party app to sift through, compare, and transfer over file modifications.
Upgrades are absolute necessities for security and for keeping up with browsers/changing technology. I've personally seen groups of hackers who specialize in open source apps and hit large numbers of websites in one sweep that missed the latest patch. Its easy to find these sites using a Google query.
Just my view, but what I've seen in this 1.3.8 update concerns me. It is just too cumbersome for the typical open source user (like my clients). Users become obliviously dependent on the simplicity of open source and, frankly, open source is usually packaged for these common persons...not the rest of us who work with files and code.
Thanks to all who made Zen Cart and the mods possible. Thanks, too, to Dr. Byte who has always been most helpful. Just please consider issuing upgrades as patches in the future. I think its better for the integrity of the Zen Cart in the bigger picture. Thanks
websitebob