Issue #2357249 by Stefan Horst, greggles, larowlan, David_Rothstein, klausi: Fixed SA-CORE-2014-005 (SQL injection).
Issue #2357311 by penyaskito: Fixed Follow-up to SA-CORE-2014-005 (tests don't work correctly on non-MySQL databases).
Issue #2348365 by larowlan | mtdowling: Update to Guzzle 5.
Issue #2351777 by chx, claudiu.cristea: Do not depend on event subscribers for security: Replace AccessRouteSubscriber with build-in checks.
Issue #2350949 by Wim Leers: Add hook_page_attachments(_alter)() and deprecate hook_page_build/alter().
Issue #2341341 by YesCT, martin107, vijaycs85, fran seva: Change public 'name' property access on languages to getName() and add back setName().
Issue #2349851 by targoo: Remove uses of the deprecated drupalGetSettings.