After dropping by joomla.org and seeing these big words in red:
CRITICAL UPGRADE
MUST UPGRADE
SECURITY
VULNERABILITY
I decided to go ahead and upgrade from 1.0.8 (I skipped 1.0.9 because of many reported problems).
So far so good but it did mess up the Who's Online module which is the only one that doesn't put a return between every user... That sucks but other than that so far so good.
(I'm knocking on wood now).