- resolve: introduce reference counting on DnsStream (#2110544)

- core: Detect initial timer state from serialized data (#1764908)

- core: don't update unit description if it is already set to the same value (#1793527)
- unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
- core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)

- core: make sure to restore the control command id, too (#1837973)

- sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1817504)
- sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1820073)
- sd-journal: remove the dead code and actually fix #14695 (#1820073)
- swap: adjust swap.c in a similar way to what we just did to mount.c (#1821261)
- swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1821261)

- core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1810576)
- core: rework StopWhenUnneeded= logic (#1810576)
- fix the fix for #1691511 (#1809159)

- unit: fix potential use of cgroup_path after free() when freeing unit (#1778083)

- core: exclude .slice units from "systemctl isolate" (#1751130)

- update for 7.7
  . https://access.redhat.com/errata/RHBA-2019:1895
  . https://access.redhat.com/errata/RHSA-2019:2091
  . https://access.redhat.com/errata/RHBA-2019:2356
- security issues
  . CVE-2018-15686 line splitting via fgets() allows for state injection during daemon-reexec
  . CVE-2018-16866 out-of-bounds read when parsing a crafted syslog message
  . CVE-2018-16888 kills privileged process if unprivileged PIDFile was tampered

- rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1701230)

- Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)

- sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)

- journald: free cmdline buffers owned by iovec (#1666646) - 62.3 backport (not yet 62.3)
- dhcp6: make sure we have enough space for the DHCP6 option header
- journald: do not store the iovec entry for process commandline on stack (#1657788)
- journald: set a limit on the number of fields (1k) (#1657792)
- journal-remote: set a limit on the number of fields in a message (#1657792)
- security issues
  . CVE-2018-15688 Out-of-bounds heap write in systemd-networkd dhcpv6 option handling
  . CVE-2018-16864 stack overflow when calling syslog from a command with long cmdline
  . CVE-2018-16865 stack overflow when receiving many journald entries

- improve RLIMIT_NOFILE handling GH#5795

- cryptsetup-generator: introduce basic keydev support (#1619743)
- cryptsetup-generator: don't return error if target directory already exists (#1619743)
- cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
- Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)

- restart automounts unit on update (#1596241)

- umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
- core: Implement timeout based umount/remount limit (#1571098)
- core: Implement sync_with_progress() (#1571098)

- sd-journal: properly handle inotify queue overflow (#1540538)
- sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
- journalctl: Periodically call sd_journal_process in journalctl (#1540538)
- sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)

- journal: remove error check that never happens (#1465759)
- sd-journal: various clean-ups and modernizations (#1465759)
- journalctl: continue operation, even if we run into an invalid file (#1465759)
- journalctl: when we fail to open a journal file, print why (#1465759)
- sd-journal: properly handle inotify queue overflow (#1540538)
- sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
- sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)
- journalctl: Periodically call sd_journal_process in journalctl (#1540538)

- automount: ack automount requests even when already mounted (#1535135)

- manager: fix connecting to bus when dbus is actually around (#7205) (#1465737)

- manager: when reexecuting try to connect to bus only when dbus.service is around (#6773) (#1465737)

- Revert "udev: net_id: add support for phys_port_name attribute (#4506)" (#1477285)
- reintroduce naming based on phys_port_name for mlxsw and rocker via udev rule

- Revert "rules: move cpu hotplug rule to separate file" (#1465108)

- core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
- core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)
- core: properly handle jobs that are suppressed to JOB_NOPs when propagating restarts (#1436021)

- tmp.mount.hm4: After swap.target (#3087) (#1298355)
- make sure all swap units are ordered before the swap target (#1298355)

- load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
- core: fix assertion check (#1396312)

- fixed SHELL variables on command path

- security issues
  . CVE-2016-7795
    A flaw was found in the way systemd handled empty notification messages. A
    local attacker could use this flaw to make systemd freeze its execution,
    preventing further management of system services, system shutdown, or zombie
    process collection via systemd.

- core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
- logind: process session/inhibitor fds at higher priority (#1305608)
- sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
- manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
- manager: Fixing a debug printf formatting mistake (#1342173)
- manager: don't skip sigchld handler for main and control pid for services (#3738) (#1342173)

- manager: reduce complexity of unit_gc_sweep (#3507) (#1344556)

- fstab-generator: cescape device name in root-fsck service (#1306126)
- get rid of ldconfig.service (#1338892)

- journal: fix error handling when compressing journal objects (#1292447)
- journal: irrelevant coding style fixes (#1292447)

- Revert "udev: fibre channel: fix NPIV support" (#1266934)
- udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
- rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)
- ata_id: unreverse WWN identifier (#1308795)
- Fixup WWN bytes for big-endian systems (#1308795)
- udev: fibre channel: fix NPIV support (#1266934)

- Avoid /tmp being mounted as tmpfs without the user's will (#1298109)

- enable use SHELL variable on command path
- call rc.local.mine in rc.local
- no clear to tty1 after booting

- fixed #1243401 force machined to dispatch messages
- add execute permission rc.local