- Patch #76824 by geerlingguy, xjm, droplet, kbahey: Drupal should not handle 404 for certain files. Oh yeah.

- Patch #195416 by Damien Tournoud, David Strauss: table prefixes should be per database connection.

- Patch #302327 by Josh Waihi, noahb, Crell, hswong3i: support cross-schema/database prefixing like we claim to.

- Patch #258397 by John Morahan, Dries, R.Muilwijk, Bart Jansens, grendzy, Berdir: IP address identification not broad enough.

- Patch #590656 by pwolanin, Pasqualle: harden one-time login links against vulnerability from disclosure of SQL backups, or SQL 'SELECT' injection.

#605924 by ksenzee: Rename default.sites.php to example.sites.php. There is no 'default' about it, and it also screws up tab completion. :P

#67234 by Ralf, Dave Reid, David_Rothstein, Rob Loach, dww, et al: Added a permission to update.php.

- Patch #570572 by winston, David_Rothstein | Shai, Xano, alexanderpas, emmajane, kazar: changed label for user/1 account from 'administrator' to 'site maintenance account'.

#370454 follow-up by chx: Enhance comments to page cache simplification patch, and add in missing settings.default.php hunk.

- Patch #72856 by quicksketch: on some systems, PHP's garbage collector is disabled so make sure to enable it.

- Patch #334283 by Damien Tournoud, andypost, Freso et al: add context to t() to help deal with ambigious strings (and improved the locale APIs a bit). Example: May is both a short month name as a long month name in English, but not necessarily in other languages.

- Patch #147310 by c960657: added tests for private files, fixed a problem with private files and minor improvements.