- sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)

- journald: free cmdline buffers owned by iovec (#1666646) - 62.3 backport (not yet 62.3)
- dhcp6: make sure we have enough space for the DHCP6 option header
- journald: do not store the iovec entry for process commandline on stack (#1657788)
- journald: set a limit on the number of fields (1k) (#1657792)
- journal-remote: set a limit on the number of fields in a message (#1657792)
- security issues
  . CVE-2018-15688 Out-of-bounds heap write in systemd-networkd dhcpv6 option handling
  . CVE-2018-16864 stack overflow when calling syslog from a command with long cmdline
  . CVE-2018-16865 stack overflow when receiving many journald entries

- improve RLIMIT_NOFILE handling GH#5795

- cryptsetup-generator: introduce basic keydev support (#1619743)
- cryptsetup-generator: don't return error if target directory already exists (#1619743)
- cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
- Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)

- restart automounts unit on update (#1596241)

- umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
- core: Implement timeout based umount/remount limit (#1571098)
- core: Implement sync_with_progress() (#1571098)

- sd-journal: properly handle inotify queue overflow (#1540538)
- sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
- journalctl: Periodically call sd_journal_process in journalctl (#1540538)
- sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)

- journal: remove error check that never happens (#1465759)
- sd-journal: various clean-ups and modernizations (#1465759)
- journalctl: continue operation, even if we run into an invalid file (#1465759)
- journalctl: when we fail to open a journal file, print why (#1465759)
- sd-journal: properly handle inotify queue overflow (#1540538)
- sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
- sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)
- journalctl: Periodically call sd_journal_process in journalctl (#1540538)

- automount: ack automount requests even when already mounted (#1535135)

- manager: fix connecting to bus when dbus is actually around (#7205) (#1465737)

- manager: when reexecuting try to connect to bus only when dbus.service is around (#6773) (#1465737)

- Revert "udev: net_id: add support for phys_port_name attribute (#4506)" (#1477285)
- reintroduce naming based on phys_port_name for mlxsw and rocker via udev rule

- Revert "rules: move cpu hotplug rule to separate file" (#1465108)

- core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
- core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)
- core: properly handle jobs that are suppressed to JOB_NOPs when propagating restarts (#1436021)

- tmp.mount.hm4: After swap.target (#3087) (#1298355)
- make sure all swap units are ordered before the swap target (#1298355)

- load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
- core: fix assertion check (#1396312)

- fixed SHELL variables on command path

- security issues
  . CVE-2016-7795
    A flaw was found in the way systemd handled empty notification messages. A
    local attacker could use this flaw to make systemd freeze its execution,
    preventing further management of system services, system shutdown, or zombie
    process collection via systemd.

- core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
- logind: process session/inhibitor fds at higher priority (#1305608)
- sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
- manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
- manager: Fixing a debug printf formatting mistake (#1342173)
- manager: don't skip sigchld handler for main and control pid for services (#3738) (#1342173)

- manager: reduce complexity of unit_gc_sweep (#3507) (#1344556)

- fstab-generator: cescape device name in root-fsck service (#1306126)
- get rid of ldconfig.service (#1338892)

- journal: fix error handling when compressing journal objects (#1292447)
- journal: irrelevant coding style fixes (#1292447)

- Revert "udev: fibre channel: fix NPIV support" (#1266934)
- udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
- rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)
- ata_id: unreverse WWN identifier (#1308795)
- Fixup WWN bytes for big-endian systems (#1308795)
- udev: fibre channel: fix NPIV support (#1266934)

- Avoid /tmp being mounted as tmpfs without the user's will (#1298109)

- enable use SHELL variable on command path
- call rc.local.mine in rc.local
- no clear to tty1 after booting

- fixed #1243401 force machined to dispatch messages
- add execute permission rc.local