- Patch ##239676 by v1nce, pwolanin, mfb: fixed SA-CORE-2009-001: missing validation for hook_user().

#497948 by roychri and Rob Loach: Fixed terribly broken Color module (with tests so we don't do it again ;)).

#471018 follow-up by sun: Apply generic pattern/js for hiding machine readable names to taxonomy vocabularies.

#364219 follow-up by TheRec: One last API nicety to theme_links() for the accessibility header stuff.

#321828 by Davy Van Den Bremt and Damien Tournoud: Move template_preprocess_maintenance_page() to theme.inc to allow Drupal to properly report fatal errors.

#564582 by Damien Tournoud: Remove dead code user_edit_submit() and user_edit_validate(). Yay for patches that remove old crufty crap.

- Patch #495968 by Frando, moshe weitzman: added drupal_render() cache pattern. Start using it for blocks.

- Patch #444344 by kkaefer, sun, Rob Loach: this change introduces a jQuery .once() method which streamlines the way behavior functions work. Previously, we had to manually ensure that an element is only initialized once. Usually, this happens by adding classes and selecting only those elements which do not have that class. However, this process can be separated out into a jQuery ‘filtering’ function which does all the grunt work.

- Patch #331171 by pwolanin, mfb, drewish: allow modules to alter the MIME extension mapping rather than setting a huge variable.