- Patch #736298 by effulgentsia, eojthebrave, andypost, robeano: fixed Refactor file.module to use proper button click detection, enabling FAPI to improve button click detection security.

- Patch #620618 by sun, Damien Tournoud, JohnAlbin, makara: optimize menu tree building and use it for toolbar.

- Patch #327331 by mr.baileys, wrwrwr: fix filter_xss() to not allow empty style/on* attributes at end of opening tag.

- Patch #740036 by c960657, Damien Tournoud: Fixed OpenID AX: Request nickname + support alternative namespaces.

#842394 by Stevel: Add dependency to filter_update_7005 so that it runs after the addition of role weight column.

- Patch #786322 by trevjs: documentation for file_load_multiple() still mentions {files} table, and is not conformant to standards.

- Patch #800366 by sivaji, David_Rothstein: prevent creating shortcut set with empty or duplicate label.

- Patch #134321 by dvessel, dboulet: if default color profile base and original style.css background color are the same, output is invalid CSS background.

- Patch #721086 by rfay, aspilicious, andypost: create tests for system actions, clean up token replacement, clean up triggers.

- Patch #831914 by Dave Reid: removed redundant/duplicate [node:uid], [comment:uid], and [file:uid] tokens.

- Patch #837728 by aaronbauman: @see directives in system.api.php: move to bottom of docblocks, prepend blank line.

#838438 follow-up by Damien Tournoud: db_prefix is no longer a global, wrong path given to drupal_var_export() function file.

- Patch #195416 by Damien Tournoud, David Strauss: table prefixes should be per database connection.

#660302 follow-up by heyrocker and jhodgdon: Fixed Migration path for changed user email tokens; don't complicate translation of default messages.

#838438 by Damien Tournoud, chx: Added basic tests for D6 => D7 upgrade path, and framework for further extending upgrade test coverage. W00t! :D