- Added support for 403 handling.  Patch by JonBob.  As a side benefit,
  administrators will be able to define a custom 403 page, just as they
  can define 404 pages now.

  This needs to be documented in the "Changes since / migrating to ..."
  pages.

- Fixed problem with global session variable that caused the wrong page to
  be rendered after posting a comment.

- Patch 6675 by Ax: reorganized the menu's of the watchdog and statistics module
  to be more intuitive and moved some help text to Doxygen comments.

- Patch #7163 by walkah: blogapi mt.getCategoryList should return an empty array by default.  Reported by Adriaan.

  configurable!  Menu items can be disabled, repositioned, added and
  so on.

  Upgrading to requires you to run update.php.

  This functionality depricates some of the 'navigation modules' in the
  contributions repository.  Furthermore, modules can now 'suggest'
  menu items and site adminstrators can choose to enable them.  Modules
  in the contributions repository should try to take advantage of this.

Truncate UTF-8 patch. Introduced a new function truncate_utf8() for chopping off strings at unsure locations, without risking incomplete UTF-8 data.

Poll.module / Statistics.module: fixing bug caused by using array_merge and drupal_map_assoc. This causes array keys to be renumbered, leading to bugs.
Remember to use $array1 + $array2 instead.

- Patch #7120 by MegaGrunt: made the title of nodes the same size on home page as on the node page and improved the various header styles to give better visual indication of hierarchy.

- Patch #6829 by kika: cleanup of drupal.css.  The patch did not apply 100% cleanly so hopefully everything is well.

- Patch #6947 by Ax: fixed a Doxygen warning, fixed some uninitialized varables.

  (I'm back from vacation.)

- Tiny usability improvement for translators.  Patch by Gerhard.

- Profile module improvement:
   * Made it possible to set certain fields as 'required'.

  To do:
   * Mark them as required visually.
   * Add required fields to the subscription page.

- Patch #6425 by TDobes: made avatars work with private download method.  Added
  user_file_download() function to communicate with the file system layer.

Patch 6523 by Steven:

- Strips the leading / from URLs to match with block paths. The reason is that everywhere else in Drupal, we use URLs without leading slash (e.g. URL aliasing). For consistency we should keep this behaviour everywhere. The replacement uses ereg_replace instead of str_replace, but the expression now only match the beginning of the URI so in fact it's faster, esp. for longer URIs.

- Updates the block docs about path matching: gets rid of leading slash, adds initial matching operator '^' and emphasises the slash behaviour (which was not mentioned anywhere before)

- Replaces the example expression for a negative match. It was horribly broken and odd, the replacement in this patch is correct and simpler.

- Patch #6517 by kika: drupal_http_request() fails to open feed because on PHP 4.1.2.  Also updated file.inc.