- ZF2013-01: Query route (http://framework.zend.com/security/ZF2013-01)
- ZF2013-02: RNG support (http://framework.zend.com/security/ZF2013-02)
- ZF2013-03: DB platform quoting (http://framework.zend.com/security/ZF2013-03)
- 2752: `Zend_Json_Server` to accept null parameters
  (https://github.com/zendframework/zf2/issues/2752)
- 3696: `Zend\Json\Server\Server` should allow parameters with NULL values
  (https://github.com/zendframework/zf2/issues/3696)
- 3767: Allow NULL parameter values in `Zend/Json/Server`
  (https://github.com/zendframework/zf2/issues/3767)
- 3827: Fix mismatches between the PHPDoc and the method signatures
  (https://github.com/zendframework/zf2/issues/3827)
- 3840: allow a null page in pages array, to compensate for ZF issue #3823
  (https://github.com/zendframework/zf2/issues/3840)
- 3842: Hotfix/zend test improve console usage
  (https://github.com/zendframework/zf2/issues/3842)
- 3849: Check if values are set in `Zend\Db\Sql\Insert.php` for prepared
  statement
  (https://github.com/zendframework/zf2/issues/3849)
- 3867: `FileGenerator::setUses()` MUST can take arguments from
  `FileGenerator::getUses()`
  (https://github.com/zendframework/zf2/issues/3867)
- 3868: `ClassGenerator::fromReflection` not generate class properties
  (https://github.com/zendframework/zf2/issues/3868)
- 3869: Remove BC break in `Identical` validator
  (https://github.com/zendframework/zf2/issues/3869)
- 3871: The method delete on the `RowGateway` now returns the affected rows
  (https://github.com/zendframework/zf2/issues/3871)
- 3873: Fixes an issue when binding a model to a form collection element
  (https://github.com/zendframework/zf2/issues/3873)
- 3885: Hotfix/add tests console adapter
  (https://github.com/zendframework/zf2/issues/3885)
- 3886: Add tests console prompt
  (https://github.com/zendframework/zf2/issues/3886)
- 3888: `DefinitionList` `hasMethod` fix
  (https://github.com/zendframework/zf2/issues/3888)
- 3907: Add tests console request response
  (https://github.com/zendframework/zf2/issues/3907)
- 3916: Fix PUT HTTP method usage with params
  (https://github.com/zendframework/zf2/issues/3916)
- 3917: Clean the Console abstract adapter
  (https://github.com/zendframework/zf2/issues/3917)
- 3921: [+BUGFIX] Fixed column names bug `Zend\Db\Sql\Select`
  (https://github.com/zendframework/zf2/issues/3921)
- 3925: Added view and validator dependency
  (https://github.com/zendframework/zf2/issues/3925)
- 3936: Improve the remove of `SendResponseListener`
  (https://github.com/zendframework/zf2/issues/3936)
- 3946: Adding config to `openssl_pkey_export()`
  (https://github.com/zendframework/zf2/issues/3946)
- 3947: fix exception %s passed variable of 'A service by the name or alias %s'  should be $name
  (https://github.com/zendframework/zf2/issues/3947)
- 3948: Bug/merging translator textdomains
  (https://github.com/zendframework/zf2/issues/3948)
- 3950: Fix zero value in argument
  (https://github.com/zendframework/zf2/issues/3950)
- 3957: [Hotfix] Fixed incorrect `PDO_Oci` platform recognition
  (https://github.com/zendframework/zf2/issues/3957)
- 3960: Update toString() to use late static binding for encoding methods
  (https://github.com/zendframework/zf2/issues/3960)
- 3964: Fix fluent interface
  (https://github.com/zendframework/zf2/issues/3964)
- 3966: Better polyfill support for `Stdlib` and `Session`
  (https://github.com/zendframework/zf2/issues/3966)
- 3968: fixed `Exception\InvalidArgumentException` messages in `Zend\Log`
  (https://github.com/zendframework/zf2/issues/3968)
- 3971: SessionArrayStorage doesn't preserve `_REQUEST_ACCESS_TIME`
  (https://github.com/zendframework/zf2/issues/3971)
- 3973: Documentation improvement `Zend\View\Stream`
  (https://github.com/zendframework/zf2/issues/3973)
- 3980: change `HOST_DNS_OR_IPV4_OR_IPV6` to `0x13` for `$validHostTypes`
  (https://github.com/zendframework/zf2/issues/3980)
- 3981: Improve exception messages
  (https://github.com/zendframework/zf2/issues/3981)
- 3982: Fix `\Zend\Soap\AutoDiscover` constructor
  (https://github.com/zendframework/zf2/issues/3982)
- 3984: Update `ArrayStack.php`
  (https://github.com/zendframework/zf2/issues/3984)
- 3987: Fix ChromePhp logger interface and debug level
  (https://github.com/zendframework/zf2/issues/3987)
- 3988: Fix & Unit test for `preparestatement` notices
  (https://github.com/zendframework/zf2/issues/3988)
- 3991: Hotfix/3858 - `findHelper` problem in Navigation Helper
  (https://github.com/zendframework/zf2/issues/3991)
- 3993: `SessionArrayStorage` Request Access Time and Storage Initialization
  (https://github.com/zendframework/zf2/issues/3993)
- 3997: Allow https on scheme without a hostname
  (https://github.com/zendframework/zf2/issues/3997)
- 4001: Fix `ViewFeedStrategyFactory` comment
  (https://github.com/zendframework/zf2/issues/4001)
- 4005: Hotfix/case sensitive console
  (https://github.com/zendframework/zf2/issues/4005)
- 4007: Pass `ClassGenerator` instance instead of boolean
  (https://github.com/zendframework/zf2/issues/4007)
- 4009: Minor if to else if improvement
  (https://github.com/zendframework/zf2/issues/4009)
- 4010: Hotfix/zend test with console route
  (https://github.com/zendframework/zf2/issues/4010)