- Patch #327331 by mr.baileys, wrwrwr: fix filter_xss() to not allow empty style/on* attributes at end of opening tag.

- Patch #348448 by mfb, c960657, marvil07, cdale, jpmckinney: fixed PHP strict warnings when running tests and for PHP 5.3.

- Patch #91663 by sun, Berdir, swentel, blackdog, chx: permission of text format is not checked when editing an entity and instead reset to something a user can use.

- Patch #721536 by JacobSingh, jpmckinney, Damien Tournoud, David_Rothstein: HTML corrector filter has problems with unescaped CDATA and incorrectly closed tags.

#414424 by sun, chx, Arancaytar, yched, et al: Introduce Form API #type 'text_format' for additional DX/security around rich text fields.

- Patch #679530 by sun, David_Rothstein: administer filters permission should not affect text format widget.

- Patch #721536 by JacobSingh: fixed inline Javascript not working due to unescaped CDATA element created by saveXML().

Roll-back of node titles as fields. The Entity Translation module in
contrib can add this back, but for everyone else it creates a *huge* WTF.
Apologies for how late this is coming, but better now than post-alpha. :\

- Patch #626024 by sun, catch: fixed filter_list_format() hits database too often / filter_format_save() doesn't save all filters.

#606526 by axyjo and scor: Remove trailing whitespace and add newlines at end of files. Sorry, folks! But it is after code freeze. :)

- Patch #560738 by sun, noahb, David_Rothstein | dropcube: trying to delete a text format gives 'page not found'.

- Patch #11218 by David_Rothstein, sun, quicksketch, duncf, awood456, dropcube, mgifford | pwolanin, dww, RobRoy, Crell, webchick, beginner, ray007, bjaspan, chx, Gábor Hojtsy, Steven, Dries, lutegrass, sym, guardian, matt2000, geerlingguy, SeanBannister, matt westgate, com2, praseodym: allow default text formats per role, and integrate text format permissions.

- Patch #470840 by salvis, sinasquax, sun: fixed bug in node_access() if we specify an account. Extend filter_access() to take custom account.

#560740 by sun and David_Rothstein: 'Escape all HTML' filter did not escape any HTML. Now that's a problem. (with tests)

#561970 by Davy Van Den Bremt: Rename 'box' to 'custom block'. Here's to core's database schema making sense.

- Patch #559658 by sun, dropcube: store filter settings per format, general API clean-up and documentation improvements.

- Patch #428296 by dropcube, sun, catch: filter system doesn't communicate with other modules about filter format changes/deletions.

- Patch #546336 by sun, dropcube: code clean-up and documentation improvements for the filter hooks.

#362972 by tic2000 and stewsnooze: Have nofollow filter remove 'rel' attributes instead of just adding rel='nofollow'.