- Patch #310139 by pwolanin, c960657: drupal_query_string_encode() should not call drupal_urlencode().

#373201 by moshe weitzman, chx, Frando, eaton: Allow renderable array properties to be passed directly to theme functions.

- Patch #395472 by JacobSingh, chx, cwgordon7: more improvements to the file transfer system to pave the path for a plugin manager.  Heroic effort.

- Patch #306027 by agentrickard, catch, dereine, Dave Reid, drewish, et al: automatically clean the {role_permission} table when modules are uninstalled.

- Patch #453254 by Pasqualle, Gábor Hojtsy: re-introduce per-content type visibility to block settings.

- Patch #497612 by Moshe Weitzman et al: harden user login by correctly using the form API.  Complete commit now.  Thank you, thank you.