- Patch #76824 by geerlingguy, xjm, droplet, kbahey: Drupal should not handle 404 for certain files. Oh yeah.

- Patch #195416 by Damien Tournoud, David Strauss: table prefixes should be per database connection.

- Patch #302327 by Josh Waihi, noahb, Crell, hswong3i: support cross-schema/database prefixing like we claim to.

- Patch #258397 by John Morahan, Dries, R.Muilwijk, Bart Jansens, grendzy, Berdir: IP address identification not broad enough.

- Patch #590656 by pwolanin, Pasqualle: harden one-time login links against vulnerability from disclosure of SQL backups, or SQL 'SELECT' injection.

#67234 by Ralf, Dave Reid, David_Rothstein, Rob Loach, dww, et al: Added a permission to update.php.

- Patch #570572 by winston, David_Rothstein | Shai, Xano, alexanderpas, emmajane, kazar: changed label for user/1 account from 'administrator' to 'site maintenance account'.

#370454 follow-up by chx: Enhance comments to page cache simplification patch, and add in missing settings.default.php hunk.

- Patch #72856 by quicksketch: on some systems, PHP's garbage collector is disabled so make sure to enable it.

- Patch #334283 by Damien Tournoud, andypost, Freso et al: add context to t() to help deal with ambigious strings (and improved the locale APIs a bit). Example: May is both a short month name as a long month name in English, but not necessarily in other languages.

- Patch #147310 by c960657: added tests for private files, fixed a problem with private files and minor improvements.

- Patch #430342 by kkaefer et al: usability improvement: changed 'site maintenance' to 'maintenance mode'.

#330983 by recidive and boombatower: Rename users/users_roles tables to user/user_role for consistency.