#107824 by Frando, heyrocker, Dave Reid, AlexisWilke, andypost: the dblog referer and the statistics url columns were not in line with how we store URLs elsewhere (like the dblog location column); could result in data loss due to length truncation

#295895 by Michelle, JohnAlbin: Garland mistakenly used phptemplate_comment_wrapper() to override comment-wrapper.tpl.php; should use a preprocess function instead to complement the core comment-wrapper.tpl.php

#276615 by JacobSingh, Robin Monks, mikeytown2: drupal_clear_css_cache() should not be called on all invocations to the themes admin page; should be called only on submit - consistent with the modules admin page

#454462 by JohnAlbin: MODULE_preprocess_maintenance_page() functions were never called, even if the database is online

#359276 by lyricnz, Heine, Frando: Fix named entity handling in filter_xss(), so it does not clash with other entities and result in wrong encoding

#280240 by skiminki, casperbiering, anypost, pwolanin: Only add Content-Length if we actually have any content or if it is a POST or PUT request.

#506096 by axjo: node.tpl.php mistakenly mentions theme_user(); should reference theme_username() instead

#409994 by Wesley Tanaka, jhodgdon: better documentation on how the cid and wildcard arguments interact on cache_clear_all()

#265265 by neochief, jhodgdon: missing phpdoc @code tags on PHP code examples in form.inc and actions.inc

#499254 by chx: Drupal lacked support for positive integer values in database queries, beyond PHP_INT_MAX; caused issues with twitter integration and big numbers in general

#310139 by fonant, c960657, pwolanin: drupal_urlencode() and Drupal.encodeURIComponent was used to encode query strings and other components it should not have been used for

#284392 by Passionate_Lass, Anselm Heaton, tassoman, agentrickard: DISTINCT handling in db_distinct_field()'s MySQL implementations was resulting in bogus queries

#482646 follow up by Dave Reid: only check the db prefix for simpletest if it was a string (not running a multisite)

#352121 by valthebald, Damien Tournoud, mr.baileys: The safe string check on translations should only be applied to the default textgroup. Strings in other textgroups such as blocks and menu items are displayed via escaping and filtering, and might contain arbitrary HTML.

#329797 by berenddeboer, redndahead, danielb: The tablesort code did not account for possibly nested tables; only match immediate descendats, so elements of nested tables are not matched.

#455172 by budda, RoboPhred, andypost: Fix drupal_mail() documentation, so that it encourages to set the body of the email as an array (like core does).

#461938 by grendzy, JamesAn: Use filter_xss_admin() on site name and site slogan, just like footer message and mission

#339466 by patryk, c960657, alexanderpas: Remove url() wrapping from remote links and link in a more user friendly OpenID provider list.

#243253 by Benjamin Melançon, dww: Update status should not attempt to request update data until a limit is reached. Fixed Drupal instances when drupal.org is down and gets less load on Drupal.org if data is not found.

#236657 by hctom, swentel: In system_clear_cache_submit(), the function arguments were swapped (but it did not affect how it actually worked).

#373225 by jpulles, Josh Waihi: When changing columns, PostgreSQL needs explicit type casting to ensure that values are kept properly.

#145733 by kepten, brianV: The session.use_cookies PHP setting is required by Drupal, but it can be turned off, so try to ensure it is turned on at all times.

#197266 by ufku, lilou, Dave Reid, c960657, drewish: Save a query by only calling file_space_used() when a limit is provided.

#482646 by Dave Reid: For proper HTTP query simpletesting, we should pass on the instance identifier (database prefix).

#226479 by gpk, BrianV, catch: We should always show the node access rebuild button. The check on when to show it was fragile, so the button might not have been there when actually needed.

#246096 by Sutharsan, Pedro Lozano, mr.baileys, andypost: Actions set to run on cron were not actually triggered.

#465190 by Heine: The Anonymous name is a plain text setting, so it should be escaped properly for output.

#445748 by Dave Reid, dww: Fix module support for disabled module update status checking and do not track usage in that case.

#398902 by Nick Urban, alexanderpas, kscheirer: password equality checking was not using strict type checking; we should assume these are strings and compared character to character

#460420 by wulff, andypost: drupal_set_title() in forum_overview() is not needed; menu already sets the title and is localized

#468732 by andypost: cache_clear_all() mentioned cache_flush_delay incorrectly; it should say we use cache_lifetime

#452704 by andypost, catch: Names of compressed CSS and JS files should have a prefix, so that names starting in ad* will not happen. Those are easily blocked by firewalls, Firefox's Adblock, etc.