SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) #1195
Fix XSS vulnerabilities in Rails (CVE-2012-3464, CVE-2012-3465) #1113 #1114
Update Copyright for 2013

We programmers have a nice new years tradition: We revisit all of
our projects and add 1 to a small number near a "(c)".

-- Volker Dusch
https://twitter.com/__edorian/status/153801913442373633
Update Changelog for v2.7.4
Bump version to v2.7.4
Bump Rails version to 2.3.15 #1200
Remove Rails patches which are already included in Rails 2.3.15 #1200
Update Changelog for v2.8.0
Bump version to 2.8.0
Fix for CVE-2013-0155 in Rails
Update Changelog for v2.8.1
Bump version to v2.8.1
Bump Rails version to 2.3.16 #1219
Remove Rails patches which are already included in Rails 2.3.16 #1219
Update Changelog for v2.9.0
Bump version to v2.9.0
Improve on broken MySQL handling of login tokens #1234
Bump Rails to 2.3.17 #1233
Don't set YAML on serialized fields #1233
Bump json gem to a safe version for CVE-2013-0269, CVE-2013-0333