Major features

Navigation improvements
One of the biggest project was improvements in Navigation and Users pages, see also MDL-45774.
It includes:

MDL-45894, MDL-49634 - Grades page listing all my courses, and all courses I am teaching in
one place (linked from User Menu)
MDL-48936 - My Home is now Dashboard
MDL-48932, MDL-45898 - Redesign profile page, make it pluggable
MDL-45895 - New Preferences page (linked from user menu)
MDL-45896 - Consistent header for user pages
MDL-48931 - Consistent header for user sub pages
MDL-48935 - Consistent bread crumbs for user pages
MDL-49635 - Remove redundant nodes from nav tree
MDL-49983 - Improve consistency of the use of the word "My" in navigation

User interface improvements

MDL-43996 - Drag and drop image into Atto editor inserts it as a file
MDL-19670 - Teacher can post the same forum question to all groups at once
MDL-47172 - You have assignments that need attention in the course overview block displays
relevant information for teachers
MDL-48933 - Ajax interface for messaging
MDL-23296 - Provide search function for Server files area in the file picker
MDL-48937 - Don't show the category in the breadcrumb if there is only one category
MDL-26226 - Section names in the navigation can link to the sections
MDL-49694 - Overview report shows the full course name
MDL-47527 - Allow access to overview report for users who can view all grades
MDL-36009, MDL-46662 - Grader report accessibility improvement
MDL-47562 - UI Fixes and improvements for SingleView report
MDL-47434 - Do not display 'General' section in navigation block if it's empty
Course creation improvements

MDL-10405 - Added button to quickly delete a whole section on the course homepage
MDL-31500 - Allow backup and restore on the front page
MDL-5583 - Fields in database module can be set as required
MDL-28526 - Glossary can export/import embedded images and attached files
MDL-49006, MDL-49101 - Removed default requirement of activity description and substituted
with a single setting
MDL-13831 - Grade to pass can be set by editing activity without going to gradebook
MDL-46960 - Completion status is updated immediately for student when activity is graded
MDL-27074 - Display group name for group events in the calendar
MDL-48969 - New activity results block
MDL-18177 - Add option to choose whether groups and/or groupings are included in a back up
MDL-20053 - Database activity: create ##userpicture## tag to allow the user's profile picture to
be displayed
MDL-49543 - Add a WYSIWYG field to Badges which is displayed on the criteria page
MDL-46416 - Possible to change / remove picture from group
MDL-49687 - Adding a single person to multiple groups at the same time
MDL-21724 - The course edit page needs a way to redirect to some page other than the main
course page after saving
MDL-47628 - When grouping is selected for the activity display a button to quickly create access
restriction (helps users who were used to groupmembersonly)
MDL-23178 - Allow indenting again for activities in the Main Menu block
MDL-46238 - Add a simple way to go back from enrol/users.php page to the course

Administrator features

MDL-15187 - Assign global roles using CSV upload

MDL-30937 - Backup report again links to the individual course backup summaries
MDL-32547 - Configure temporary file deletion, to avoid moodledata/temp/backup filling up the
filesystem
MDL-49684 - Replace custom Moodle timezone stuff with standard PHP date/time code
MDL-25763 - CLI version of admin/replace.php
MDL-44874 - Per-request temp directories
MDL-46064 - Drop support for MyISAM
 MDL-49298 - Make tgz backups standard
MDL-47834 - New option for restriction of concurrent logins in managing authentication
MDL-47800 - Logout user when somebody changes their password
MDL-47830 - Add password rotation restrictions
MDL-48559 - Web CRON should be disabled by default
MDL-48080 - Never send mail to domains ending in .invalid
MDL-48595 - Log exports no longer fails because of memory limit
MDL-28513 - Allow specification of admin user email in CLI installer
MDL-49842 - Allow specification of front page summary in CLI installer
MDL-47803 - New page that shows all browser sessions of current user
MDL-34684 - New health check to detect incorrect category path order and/or missing parent
categories
MDL-48493 - Automatically detect the plugin type when installing from ZIP
MDL-48894 - Site registration page states if site is registered
MDL-18183 - Option to verify peer and host of MNet peer using HTTPS

Files and repositories

MDL-42616 - New admin tool for adding custom file types

MDL-43752 - Amazon S3 repository allows an endpoint to be set

Authentication, enrolments and access

Several improvements to meta enrolments, such as: populate groups from courses MDL-17929,
sorting courses alphabetically MDL-35696, button to quickly add a new method MDL-49439
MDL-26017 - Keyholder capability in self-enrolment plugin
MDL-20365 - Salted Crypt passwords option for external database authentication
MDL-49380 - Chose "Create new group" when synchronising cohort enrolment with a group
MDL-49677 - Improvement of Custom welcome message in self-enrolment plugin
MDL-43415 - Custom profile fields should be syncable with external DB auth
MDL-49638 - reCAPTCHA should be moved below custom profile fields during self registration

Quiz

MDL-40988 - Add section headings to quiz

 MDL-40992 - Option for teachers to allow students to redo a finished question within a quiz
attempt
MDL-40990 - Teachers can require students to complete Question 1 before they can see
Question 2
MDL-25721 - The question bank can be sorted by date
MDL-348 - Printer-friendly option for quizzes
MDL-6340 - force unique/unseen questions in retakes
MDL-35280 - quiz_reset_userdata does not have an option to remove user/group overrides
MDL-48898 - Quiz time period setting should use admin_setting_configduration

Lesson

MDL-48803 - support for groups

MDL-48715 - moving time spent from prerequisite to the proper completion rule
MDL-43387 - UI for grading essays
MDL-48244 - Lessons with no questions show completed after the first page is viewed
MDL-47587 - Make progress bar available on the very last page of a lesson.
MDL-49642 - Give time/date extensions to users and groups in lesson
MDL-40286 - non-editing teacher should see Grade analysis in Lesson
MDL-48473 - Lesson shortanswer question: add fill in the blank option
MDL-48984 - Lesson content page jump descriptions, numerical and shortanswer questions
answers allow rich html but should be plain text
MDL-18553 - Removing grade info from lesson pages if lesson grade is 0
MDL-26689 - in order to prevent interactivity references from being broken move the
"Dependent on" feature to the completion/availability subsystem
MDL-49183 - Page creation, update and delete events added
MDL-48883 - Content page viewed, Question page viewed and Question page answered events
added

Other modules

MDL-48221 - Make forum subscription combinations less confusing with different combinations
MDL-48822 - Find last visual post in a discussion
MDL-46755 - Allow teachers to configure the number of discussions displayed using the social
course format
 MDL-49069 - Ability to specify default values for Forum RSS
MDL-48159 - For users without group prevent submissions instead of using "Default team" in
group assignments
MDL-47777 - Convert assignment maximum files per submission maximum to global setting
MDL-45848 - Possible to assign Marker on a marking guide or rubric assignment without giving
a grade
MDL-49220 - Allow preview of Choice options before activity is opened for submission
MDL-34375 - Choice module should display information in "Course overview" block
MDL-43770 - Exclude inactive users' responses from Choice report (with an option to include)
MDL-32285 - Added "Continue" button under Error notification message (IMS CP)
MDL-49730 - Workshop: use full page width when displaying contents
MDL-36874 - Text navigation for Books
MDL-49563 - Allow glossary entry to be updated from glossary navigation

Various

MDL-46763 - Save user images as JPEG if uploaded in that format.

MDL-48760 - MathJax library updated to 2.5
MDL-47232 - Course completion: "Activities to be completed" should not require passing grade
MDL-48437 - Make Visible/All groups selector show own groups first
MDL-47501 - Add an indication that the grade letters have been overridden
MDL-47159 - Link plugin in Atto should add 'http://' prefix when necessary
MDL-9443 - Run *.xhtml file through the text filters
MDL-48616 - Add Macrons in Atto character map
MDL-46665 - ID number filter added to Browse list of users
MDL-48499 - Show which users have not received messages in bulk messaging
MDL-49333 - Return additional information in WebService core_get_site_info

Security issues
MSA-15-0018 Quiz manual-grading is an XSS risk, but does not declare that
MSA-15-0019 Possible phishing when redirecting to external site using referer header
MSA-15-0020 User fullname disclosure through account confirmation link
MSA-15-0021 Any authenticated user can subscribe to site-wide event monitor rules
MSA-15-0022 Potential XSS risk when returning text entered by student from Web Services
 MSA-15-0023 Suspended user is able to login when confirming email
MSA-15-0024 User with suspended enrolment can see sections in the navigation tree
MSA-15-0025 Capability to manage own files is not respected in Web Services

For developers
MDL-49046 - Support for Asynchronous Module Definition formatted javascript modules.
Developer docs: Javascript Modules
MDL-49163 - Support for calling webservice functions directly from javascript. Developer
docs: AJAX
MDL-49152 - Support for implementing renderers as mustache templates (php and javascript).
Developer docs: Templates
MDL-44874 - A new per-request directory API has been added, and should be used instead of
make_temp_directory wherever possible.
MDL-49604 - Support for in browser caching (localstorage) of strings and templates
MDL-49650 - Template Library - tool for displaying templates in the current theme
MDL-48887 - New auth hook to intercept code before login page is shown.
MDL-48177 - Allow plugin environment checks to work without defining explicit versions of
Moodle
MDL-46728 - WOFF2 fonts are supported in themes.
MDL-39752, MDL-49456 - Behat tests runs in parallel
MDL-49163 - Unified Ajax script handler. Developer docs: AJAX
MDL-27548 - The comments table contains the component
MDL-49269 - Add an AMD log module
MDL-49534 - Delete pear/HTTP/WebDav
MDL-48212 - Introduces a new class \core\message\message that should be used instead of
\stdClass for creating messages.
MDL-37477 - html_table API supports caption tag
MDL-49643 - Deprecate inconsistent API to extend the navigation by local plugins
MDL-49361 - Ability to provide alternate strings manager
MDL-44642 - Implemented backend to keep session alive
MDL-45725 - User preferences for flexible tables can be set persistent across sessions
MDL-49306 - When copying block instances the instance data is also copied
MDL-47915 - Theme layout "embedded" uses id='page-content' rather than 'content' to be
consistent with other layouts
 MDL-48212 - Implement new message api to support specific text only on a given handler
MDL-49262 - Delete the yui versions of the bootstrap plugins
MDL-40864 - Use div.logo instead of a.logo in Bootstrapbase / Clean / More home links
MDL-48160 - For theme developers: changes to block region layouts when coded for RTL