Spree 1.0.6 has been released. This release is just a minor patch release to fix a few issues with attr_accessible and the latest Rails 3.1.6 release. The previous Spree 1.0.5 release has been yanked since it was not compatible with the latest Rails 3.1.x version.
Please see the Github compare for a complete list of changes in this release. There are no security fixes in this release.