- Patch #431776 by catch, agentrickard, Damien Tournoud, Dries: cron should run as anonymous when invoked via the run-cron link on the status report page.

#86299 follow-up by coltrane and clojel: Stop users' passwords from being stored in users.data in plain-text. Ouch.

#556872 by Davy Van Den Bremt, pwolanin, sun, and eojthebrave: Fixed Action links do not work on all levels (example: 'add block' action link does not appear).

- Patch #600392 by merlinofchaos, sun: search_form() has an  argument but this argument is partially ignored.

- Patch #131432 by dereine, alienbrain, sun: #field_prefix() and #field_suffix() work on textfields only.

#587706 follow-up by plach: trim GET['q'] centrally in request_path() so subsequent places don't have to do it.

- Patch #503782 by skilip, Davy Van Den Bremt, eojthebrave, sign: not able to select region at block creation.

- Patch #721400 by pwolanin: order JS files according to weight, don't change filenames for aggregated JS/CSS.

- Patch #730418 by catch: allow modules to bypass taxonomy_get_tree() for term reference select lists.

#734742 by Damien Tournoud: Upgrade path: no need to change the definition of the {url_alias()} table twice.