API Require ADMIN for ?showtemplate=1
Nginx docs for denying composer file access (fixes #8011)
BUG Undefined `$allowed_actions` overrides parent definitions, stricter handling of $allowed_actions on Extension

Controller (and subclasses) failed to enforce $allowed_action restrictions
on parent classes if a child class didn't have it explicitly defined.

Controllers which are extended with $allowed_actions (through an Extension)
now deny access to methods defined on the controller, unless this class also has them in its own
$allowed_actions definition.
Improved docs on $allowed_actions

Added section to "Controllers" and "Form" topics,
added $allowed_actions definitions to all controller examples
BUGFIX Keep Member.PasswordEncryption setting on empty passwords

This will prevent empty passwords to set the encryption to 'none',
which in turn will store any subsequent password changes in cleartext.
Reproduceable e.g. with ConfirmedPasswordField and setCanBeEmpty(true).
Add ContentController->handleWidget() to $allowed_actions

Required by recent $allowed_actions security fix
Updated changelog
BUG Transaction stub methods for better cross 2.x and 3.x compat

The transactionStart() naming is 3.x, and used by some modules
which are otherwise still 2.x compatible.

Specifically, this was added to avoid branching the payment module
into separate 2.x and 3.x compatible branches.
BUG SQL Injection in CsvBulkLoader (fixes #6227)

Diff should speak for itself, looks like this will have to be implemented in all supported branches. 
Simplified travis builds (external setup scripts)
Require cms in 2.4 composer.json (which is used in travis)
Less trademark-encumbered doc icons (fixed #1787)

Thanks to http://p.yusukekamiyamane.com/
Use the correct variable as the key into $record

It was using $fieldName, which is the CSV field name, not the database
field name. This prevents duplicate detection from working. It now
properly uses $SQL_fieldName
composer/installer dep workaround

Moved to end of requirements, to work around a bug in composer - see https://github.com/composer/composer/issues/1147. This caused the dependencies to be installed in the wrong folder because the custom 'silverstripe-module' instructions hadn't been loaded at the time the core modules were installed via composer.
Fixing array to string conversion in dev/build for PHP 5.4
Updated github path
Move getTempFolder out of Core.php to own file
FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692)
FIX: Have ParameterConfirmationToken includes work regardless of include path
FIX: Ignore invalid tokens instead of throwing 403