- Patch #818686 by CrookedNumber: hyphens in style names cause paths that point to non-existent derivative images.

#776956 by CrashTest_, Damien Tournoud, effulgentsia, chx: Fixed critical bug: Complex widgets are not respecting '#disabled' state.

- Patch #655722 by ksenzee, casey, Gábor Hojtsy, bleen18, David_Rothstein: changes made in an overlay session are not reflected when the user closes the overlay.

#715142 by effulgentsia, msmithgu, mr.baileys, Damien Tournoud, sun: Fixed Various URLs escaped twice, since check_url() resp. filter_xss_bad_protocol() calls check_plain().

- Patch #846330 by JacobSingh, Gábor Hojtsy: impossible to log in with default PHP settings due to cookie lifetime.

#363580 by rfay, chx, Berdir, Rob Loach, Gábor Hojtsy, Shawn DeArmond: Fixed OpenID login fails when in maintenance mode, and 403 errors on certain user paths for logged-in users.

- Patch #749748 by mavimo, Dave Reid: contact and comment modules do not prefill with user info from cookie.

#685892 by Stevel, scor, Island Usurper, yched, quicksketch, et al: Fixed Upload -> File module upgrade path is broken.

#843278 by David_Rothstein: Fixed Menu system static caches are no longer completely cleared (causes shortcuts to not be added correctly in the overlay).

#683026 by jensimmons, JohnAlbin, Jeff Burnz, Jacine, stephthegeek, bleen18, smerrill, et al: New core theme: Bartik, a flexible, re-colorable theme with many regions that shows off what Drupal can do. Truly a team effort. :)

- Patch #736298 by effulgentsia, eojthebrave, andypost, robeano: fixed Refactor file.module to use proper button click detection, enabling FAPI to improve button click detection security.

- Patch #620618 by sun, Damien Tournoud, JohnAlbin, makara: optimize menu tree building and use it for toolbar.

- Patch #327331 by mr.baileys, wrwrwr: fix filter_xss() to not allow empty style/on* attributes at end of opening tag.

- Patch #740036 by c960657, Damien Tournoud: Fixed OpenID AX: Request nickname + support alternative namespaces.

#842394 by Stevel: Add dependency to filter_update_7005 so that it runs after the addition of role weight column.

- Patch #786322 by trevjs: documentation for file_load_multiple() still mentions {files} table, and is not conformant to standards.