- Patch #590656 by pwolanin, Pasqualle: harden one-time login links against vulnerability from disclosure of SQL backups, or SQL 'SELECT' injection.

#605924 by ksenzee: Rename default.sites.php to example.sites.php. There is no 'default' about it, and it also screws up tab completion. :P

#67234 by Ralf, Dave Reid, David_Rothstein, Rob Loach, dww, et al: Added a permission to update.php.

- Patch #570572 by winston, David_Rothstein | Shai, Xano, alexanderpas, emmajane, kazar: changed label for user/1 account from 'administrator' to 'site maintenance account'.

#370454 follow-up by chx: Enhance comments to page cache simplification patch, and add in missing settings.default.php hunk.

- Patch #72856 by quicksketch: on some systems, PHP's garbage collector is disabled so make sure to enable it.

- Patch #334283 by Damien Tournoud, andypost, Freso et al: add context to t() to help deal with ambigious strings (and improved the locale APIs a bit). Example: May is both a short month name as a long month name in English, but not necessarily in other languages.

- Patch #147310 by c960657: added tests for private files, fixed a problem with private files and minor improvements.

- Patch #430342 by kkaefer et al: usability improvement: changed 'site maintenance' to 'maintenance mode'.

#330983 by recidive and boombatower: Rename users/users_roles tables to user/user_role for consistency.

#360415 by JohnAlbin: Ship Drupal with a default sites/all/modules and sites/all/themes directory. Hooraycvs diff :D

- Patch #308834 by c960657: move setting of magic_quotes_runtime out of settings.php because (i) we don't want a user to change it and (ii) it gets executed a bit earlier in the Drupal bootstrap.

- Patch #225450 by Crell, chx, bjaspan, catch, swentel, recidive et al: next generation database layer for Drupal 7.

- Patch #293343 by Bart Jansens: removed obsolete table name from documentation.  Candidate for Most Trivial Patch of the Month Award.

  The access rules capability of user module has been stripped down to a
  simple method for blocking IP addresses. E-mail and username restrictions
  are now available in a contributed module. IP address range blocking is
  no longer supported and should be done at the server level.

  This patch is partly motiviated by the fact that at the usability testing,
  it frequently came up that users went to "access rules" when trying to
  configure their site settings.