- Patch #721436 by catch, chx, sun, eojthebrave, David_Rothstein, moshe weitzman: remove magical fairy saving of cruft from user_save().

- Patch #699440 by scor, effulgentsia, noahb, catch: add bundle support to entity_uri() callback to remove performance overhead of forum_url_outbound_alter().

#594908 by Berdir, Bojhan, mrfelton, yoroy, catch: Changed Weight categories on Configuration & Modules correctly.

- Patch #619584 by sivaji, mr.baileys, David_Rothstein, gcopenhaver: deleting a user role throws PHP notices and prevents delete operation.

- Patch #248598 by David_Rothstein, pwolanin, aspilicious: improved warning about dangerous permissions.

- Patch #721436 by catch, chx, moshe weitzman: remove magical fairy saving of cruft from user_save().

- Patch #705306 by moshe weitzman: user_cancel_delete() method calls into a 'standard' user_delete_multiple() API.

#86299 follow-up by coltrane and clojel: Stop users' passwords from being stored in users.data in plain-text. Ouch.

#677766 by matason and atheneus: Fixed Account gets blocked when user edits their profile. (with tests)

#728434 by NEOatNHNG: Fixed Default template for 'Account activation' mail doesn't contain one-time-login link.

- Patch #279851 by catch, David Strauss, Damien Tournoud, asimmonds, c960657, JohnAlbin, drawk, pwolanin, robertDouglass, coltrane: replace LOWER() with db_select() and LIKE() where possible.

- Patch #721010 by jhodgdon: actions topic group needs more functions included and better doc header.

- Patch #721436 by chx, moshe weitzman: improved performance of user_save() by removing and reworking some code.

- Patch #699842 by jhodgdon: corrected help texts and links that were broken with moving the permissions-page.

- Patch #337947 by codycraven, cwgordon7, axyjo, Jacine, grndlvl, seutje, ksenzee, Jaza, chx, sun, JacobSingh, yoroy, peximo: fixed whitespace issue for 'recent content block' in dashboard.

#86299 by pwolanin, neochief, fwalch, thePanz, et al: Security hardening: Add 'current password' field to 'change password form'.

- Patch #607238 by agentrickard: fixed user_modules_uninstalled() calling hook_permission() for already uninstalled modules.

- Patch #660302 by reglogge, samhassell, agentrickard, jhodgdon: registration e-mails should not contain passwords.