- Patch #645800 by katbailey, effulgentsia, rfay: ajax_deliver() ignores #ajax['method'] and incorrectly forces 'replaceWith' for simple AJAX callbacks, D6->D7 regression.

- Patch #755566 by effulgentsia: use of ID within theme_filter_guidelines() breaks HTML validation with more than 1 field item on a page.

#551658 by pwolanin, aaron, drewish: Move private files to an opt-in system, and no longer force private files to live within web-accessible directory.

#758804 by David_Rothstein: Remove unnecessary calls to rebuild module and theme data in the installer.

#764798 by jhodgdon, andypost, douggreen, elly, afreeman: Document that various actions can make your search index out of synch.

#764094 by David_Rothstein: Add tests to check that the theme system works in hook_init() (i.e., as early as possible).

#299308 follow-up by David_Rothstein: Fixed Installing Drupal by visiting index.php (rather than install.php) leads to a fatal error when PDO is not enabled.

- Patch #782788 by joachim, marcvangend: theme settings page help text takes the theme name from the URL.

- Patch #716718 by joachim, jhodgdon: add notes on security and proper use of user_load() to its function documentation.

- Patch #755030 by jhedstrom, sivaji, kkaefer: #field_prefix()/suffix is displayed before the label. With tests.

- Patch #765860 by effulgentsia, dww, dereine, mikey_p, sun: make drupal_alter() support multiple alter hooks executed by module weight.

#520736 by grendzy, brianV, JoshuaRogers, kjy07, Damien Tournoud, greggles: Fixed SA-CORE-2009-007 forum module XSS.

#211182 follow-up by clemens.tolboom, David_Rothstein, tstoeckler: Re-work update depencency check to deal with array_merge_recursive() edge case (with tests).

#654726 by bdurbin, sun, plach, et al: Fixed Installing Drupal 7 in non-English language doesn't pick up st() installation lists.

- Patch #737632 by Georg, casey, aspilicious: menu children take top of left region or not at all in IE.

- Patch #683988 by catch, dww, aspilicious: failure to clear the system_list() entry from {cache_bootstrap()} results in bogus results when you upgrade a module.