* Restrict the available functions in DocumentTemplate.sequence to public API's of zope.sequencesort.
* Turn UndoSupport.get_request_var_or_attr helper into a private API.
* Provide security declarations for BTreeFolder2Base class, instead of only for BTreeFolder2 via the OFS.Folder mix-in.
* LP #902068: Fixed missing security declaration for ObjectManager class.
* Fixed serious authentication vulnerability in stock configuration.