- Patch #278675 by Dave Reid, pwolanin, drewish, robertDouglass: fixed possible SQL injection risk in node_access().  Already part of Drupal 6.

#355225 by Josh Waihi and Damien Tournoud: Fix inconsistent behaviour with transaction support and insert queries. All tests should pass on PostgreSQL now. Woot! :)

#203323 by JirkaRybka, robertgarrigos, thePanz, c960657, and sun: Fix undefined index locale in install.php and clean up crufty code.

#30520 follow-up by Dave Reid: Fix error message about upload when not uploading a file (with tests, so we don't break it again).

- Patch #219584 by keith.smith, Bevan, SteveJB: rename operation in Input Formats from 'Configure' to 'View Configuration'.

- Patch #201122 by c960657, Moshe Weitzman: never write anonymous sessions, unless something has been written to . This is an important performance improvements -- as long as you use modules that use  carefully. It might be good to report some analytics about this in the performance settings page so administrators can see if there is a 'broken' module.

#350381 by tstoeckler and swentel: Add a note about running update.php to the modules page that's easier to find than the one buried under the module updates page.

#310863 by bangpound, dboulet, and catch: Stop locale module from auto-installing with custom install profiles.

- Patch #201490 by lilou, keith.smith: fixed inconsistencies in the moderation queue related help texts.

- Patch #320451 by chx, Damien Tournoud: improved Drupal's module dependency system.  This helps with fields in core.  Comes with tests\!