After repeated issues with libminiupnpc's security we disabled uPNP by default since release 0.11.1.
However this means that by default there is no port forwarding, resulting in nodes not being reachable for incoming connections by default (unless they use tor), and a reduction in the number of externally reachable nodes compared to total nodes.
NAT-PMP (RFC 6886) is another common automatic port forwarding protocol that would be much less risky than UPnP, because it uses fixed-size UDP packets instead of XML parsing. It would be fairly straightforward to support that without introducing a new dependency.
(NAT-PMP was succeeded by PCP, or RFC 6887 which is backwards compatible, probably preferable to support the lowest common denominator)
