- Patch #700704 by sobi3ch, Rob Loach, andypost: added ability to change the amount of blog posts listed.

- Patch #258397 by John Morahan, Dries, R.Muilwijk, Bart Jansens, grendzy, Berdir: IP address identification not broad enough.

- Patch #705306 by moshe weitzman: user_cancel_delete() method calls into a 'standard' user_delete_multiple() API.

- Patch #335035 by boombatower, Damien Tournoud, ksenzee, Berdir, Dave Reid, effulgentsia: Simpletest drupalPost() incorrectly submits input for disabled elements, causing unreliable testing of forms that contain them.

- Patch #431776 by catch, agentrickard, Damien Tournoud, Dries: cron should run as anonymous when invoked via the run-cron link on the status report page.

#86299 follow-up by coltrane and clojel: Stop users' passwords from being stored in users.data in plain-text. Ouch.

#556872 by Davy Van Den Bremt, pwolanin, sun, and eojthebrave: Fixed Action links do not work on all levels (example: 'add block' action link does not appear).

- Patch #600392 by merlinofchaos, sun: search_form() has an  argument but this argument is partially ignored.

- Patch #131432 by dereine, alienbrain, sun: #field_prefix() and #field_suffix() work on textfields only.

#587706 follow-up by plach: trim GET['q'] centrally in request_path() so subsequent places don't have to do it.

- Patch #503782 by skilip, Davy Van Den Bremt, eojthebrave, sign: not able to select region at block creation.