- Patch #41509 by munga: setting profile field to hidden does not remove it from the user edit form. (Today's critical bugfix #2.)

- Patch #40200 by Ax, Drewish, Zen et al: user_view() isn't merging view items correctly + CSS cleanup + form handling cleanup.

- Patch #23538 by Zen: mark required fields are being required.  The new forms API will enforce this too. :)

- Patch #24678 by jmengle, DriesK, Richard et al: bugfix: deleting a profile field doesn't delete values in profile_values table.

- Fix non-pgsql compliant ORDER BY queries
- Clean up ugly section that used db_escape_string()

  TODO:
  + The contact.module was broken; a new patch for contact.module is needed.
  + Documentation is needed.
  + The most important modules need to be updated ASAP.

- Patch #27949 by Robert: the two theme functions in profile.module both violate good theming practice by running user control logic in the middle of them. Worse yet, this isn't immediately visible since it happens in yet another function. Thus themers overriding these functions to style profile pages inadvertently break access control, thus leading to the misperception that overriding theme functions is inherently dangerous.

  (Looks like MySQL rewrites ORto IN() internally.)

  Usernames can now be themed; eg. an icon/avatar could be added.

  TODO: update contributed modules + update the migration docs.

  TODO: document the defaults in the PHPdoc comments.

- #23685: urlencode() profile field names and values in the URL (any dynamic data in an url should be urlencoded to prevent characters like # and & from being interpreted by the browser/server).