diff --git a/core/src/main/java/hudson/ClassicPluginStrategy.java b/core/src/main/java/hudson/ClassicPluginStrategy.java
index b295de6405..727bdd7fbd 100644
--- a/core/src/main/java/hudson/ClassicPluginStrategy.java
+++ b/core/src/main/java/hudson/ClassicPluginStrategy.java
@@ -66,6 +66,7 @@ import java.util.Collections;
 import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import java.util.Vector;
 import java.util.jar.Attributes;
 import java.util.jar.JarFile;
@@ -303,13 +304,19 @@ public class ClassicPluginStrategy implements PluginStrategy {
             // don't fix the dependency for yourself, or else we'll have a cycle
             String yourName = atts.getValue("Short-Name");
             if (shortName.equals(yourName))   return;
+            if (BREAK_CYCLES.contains(yourName + '/' + shortName)) {
+                LOGGER.log(Level.FINE, "skipping implicit dependency {0} → {1}", new Object[] {yourName, shortName});
+                return;
+            }
 
             // some earlier versions of maven-hpi-plugin apparently puts "null" as a literal in Hudson-Version. watch out for them.
             String jenkinsVersion = atts.getValue("Jenkins-Version");
             if (jenkinsVersion==null)
                 jenkinsVersion = atts.getValue("Hudson-Version");
-            if (jenkinsVersion == null || jenkinsVersion.equals("null") || new VersionNumber(jenkinsVersion).compareTo(splitWhen) <= 0)
-                optionalDependencies.add(new PluginWrapper.Dependency(shortName+':'+requireVersion));
+            if (jenkinsVersion == null || jenkinsVersion.equals("null") || new VersionNumber(jenkinsVersion).compareTo(splitWhen) <= 0) {
+                optionalDependencies.add(new PluginWrapper.Dependency(shortName + ':' + requireVersion));
+                LOGGER.log(Level.FINE, "adding implicit dependency {0} → {1} because of {2}", new Object[] {yourName, shortName, jenkinsVersion});
+            }
         }
     }
 
@@ -330,6 +337,14 @@ public class ClassicPluginStrategy implements PluginStrategy {
         new DetachedPlugin("junit","1.577.*","1.0")
     );
 
+    /** Implicit dependencies that are known to be unnecessary and which must be cut out to prevent a dependency cycle among bundled plugins. */
+    private static final Set<String> BREAK_CYCLES = new HashSet<String>(Arrays.asList(
+            "script-security/matrix-auth",
+            "script-security/windows-slaves",
+            "script-security/antisamy-markup-formatter",
+            "script-security/matrix-project"
+    ));
+
     /**
      * Computes the classloader that takes the class masking into account.
      *
diff --git a/core/src/main/java/hudson/model/User.java b/core/src/main/java/hudson/model/User.java
index 12146b6016..9c47b9b633 100644
--- a/core/src/main/java/hudson/model/User.java
+++ b/core/src/main/java/hudson/model/User.java
@@ -111,11 +111,17 @@ import javax.annotation.Nullable;
 @ExportedBean
 public class User extends AbstractModelObject implements AccessControlled, DescriptorByNameOwner, Saveable, Comparable<User>, ModelObjectWithContextMenu {
 
+    /**
+     * The username of the 'unknown' user used to avoid null user references.
+     */
+    private static final String UKNOWN_USERNAME = "unknown";
+
     /**
      * These usernames should not be used by real users logging into Jenkins. Therefore, we prevent
      * users with these names from being saved.
      */
-    public static final String[] ILLEGAL_PERSISTED_USERNAMES = new String[]{"anonymous", "system", "unknown"};
+    private static final String[] ILLEGAL_PERSISTED_USERNAMES = new String[]{ACL.ANONYMOUS_USERNAME,
+            ACL.SYSTEM_USERNAME, UKNOWN_USERNAME};
     private transient final String id;
 
     private volatile String fullName;
@@ -326,7 +332,7 @@ public class User extends AbstractModelObject implements AccessControlled, Descr
      * This is used to avoid null {@link User} instance.
      */
     public static @Nonnull User getUnknown() {
-        return get("unknown");
+        return get(UKNOWN_USERNAME);
     }
 
     /**
diff --git a/core/src/main/java/hudson/security/ACL.java b/core/src/main/java/hudson/security/ACL.java
index 2a1b230f5f..f66fc863c3 100644
--- a/core/src/main/java/hudson/security/ACL.java
+++ b/core/src/main/java/hudson/security/ACL.java
@@ -35,6 +35,8 @@ import org.acegisecurity.context.SecurityContextHolder;
 import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
 import org.acegisecurity.acls.sid.PrincipalSid;
 import org.acegisecurity.acls.sid.Sid;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
 
 /**
  * Gate-keeper that controls access to Hudson's model objects.
@@ -95,23 +97,34 @@ public abstract class ACL {
         }
     };
 
+    /**
+     * The username for the anonymous user
+     */
+    @Restricted(NoExternalUse.class)
+    public static final String ANONYMOUS_USERNAME = "anonymous";
     /**
      * {@link Sid} that represents the anonymous unauthenticated users.
      * <p>
      * {@link HudsonFilter} sets this up, so this sid remains the same
      * regardless of the current {@link SecurityRealm} in use.
      */
-    public static final Sid ANONYMOUS = new PrincipalSid("anonymous");
+    public static final Sid ANONYMOUS = new PrincipalSid(ANONYMOUS_USERNAME);
 
     protected static final Sid[] AUTOMATIC_SIDS = new Sid[]{EVERYONE,ANONYMOUS};
 
+    /**
+     * The username for the system user
+     */
+    @Restricted(NoExternalUse.class)
+    public static final String SYSTEM_USERNAME = "SYSTEM";
+
     /**
      * {@link Sid} that represents the Hudson itself.
      * <p>
      * This is used when Hudson is performing computation for itself, instead
      * of acting on behalf of an user, such as doing builds.
      */
-    public static final Authentication SYSTEM = new UsernamePasswordAuthenticationToken("SYSTEM","SYSTEM");
+    public static final Authentication SYSTEM = new UsernamePasswordAuthenticationToken(SYSTEM_USERNAME,"SYSTEM");
 
     /**
      * Changes the {@link Authentication} associated with the current thread
diff --git a/core/src/main/java/jenkins/util/xml/RestrictiveEntityResolver.java b/core/src/main/java/jenkins/util/xml/RestrictiveEntityResolver.java
index 87079b551e..1cf37c9bd5 100644
--- a/core/src/main/java/jenkins/util/xml/RestrictiveEntityResolver.java
+++ b/core/src/main/java/jenkins/util/xml/RestrictiveEntityResolver.java
@@ -1,5 +1,7 @@
 package jenkins.util.xml;
 
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.xml.sax.EntityResolver;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
@@ -9,9 +11,8 @@ import java.io.IOException;
 /**
  * An EntityResolver that will fail to resolve any entities.
  * Useful in preventing External XML Entity injection attacks.
- *
- * @since TODO
  */
+@Restricted(NoExternalUse.class)
 public final class RestrictiveEntityResolver implements EntityResolver {
 
     public final static RestrictiveEntityResolver INSTANCE = new RestrictiveEntityResolver();
diff --git a/core/src/main/java/jenkins/util/xml/XMLUtils.java b/core/src/main/java/jenkins/util/xml/XMLUtils.java
index 5aab9b5567..84e6f6151b 100644
--- a/core/src/main/java/jenkins/util/xml/XMLUtils.java
+++ b/core/src/main/java/jenkins/util/xml/XMLUtils.java
@@ -1,5 +1,7 @@
 package jenkins.util.xml;
 
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 import org.xml.sax.XMLReader;
@@ -21,6 +23,7 @@ import javax.xml.transform.sax.SAXTransformerFactory;
 /**
  * Utilities useful when working with various XML types.
  */
+@Restricted(NoExternalUse.class)
 public final class XMLUtils {
 
     private final static Logger LOGGER = LogManager.getLogManager().getLogger(XMLUtils.class.getName());
diff --git a/pom.xml b/pom.xml
index 76dee25796..85b782279e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,6 +98,7 @@ THE SOFTWARE.
 
     <slf4jVersion>1.7.7</slf4jVersion> <!-- < 1.6.x version didn't specify the license (MIT) -->
     <maven-plugin.version>2.7.1</maven-plugin.version>
+    <matrix-project.version>1.2.1-20150204.194845-1</matrix-project.version>
     <animal.sniffer.skip>${skipTests}</animal.sniffer.skip>
 
     <java.level>6</java.level>
diff --git a/test/pom.xml b/test/pom.xml
index 6f8cde84a1..4697c5a637 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -93,7 +93,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>matrix-project</artifactId>
-      <version>1.0-beta-1</version>
+      <version>${matrix-project.version}</version>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
diff --git a/test/src/test/java/hudson/model/AbstractItemSecurityTest.java b/test/src/test/java/hudson/model/AbstractItemSecurityTest.java
index bb711daf52..653097d295 100644
--- a/test/src/test/java/hudson/model/AbstractItemSecurityTest.java
+++ b/test/src/test/java/hudson/model/AbstractItemSecurityTest.java
@@ -46,22 +46,14 @@ public class AbstractItemSecurityTest {
 
     @Issue("SECURITY-167")
     @Test()
-    public void testUpdateByXmlIDoesNotProcessForeignResources() throws Exception {
+    public void testUpdateByXmlDoesNotProcessForeignResources() throws Exception {
         final String xml = "<?xml version='1.0' encoding='UTF-8'?>\n" +
                 "<!DOCTYPE project[\n" +
                 "  <!ENTITY foo SYSTEM \"file:///\">\n" +
                 "]>\n" +
                 "<project>\n" +
-                "  <actions/>\n" +
                 "  <description>&foo;</description>\n" +
-                "  <keepDependencies>false</keepDependencies>\n" +
-                "  <properties/>\n" +
                 "  <scm class=\"hudson.scm.NullSCM\"/>\n" +
-                "  <canRoam>true</canRoam>\n" +
-                "  <triggers/>\n" +
-                "  <builders/>\n" +
-                "  <publishers/>\n" +
-                "  <buildWrappers/>\n" +
                 "</project>";
 
         FreeStyleProject project = jenkinsRule.createFreeStyleProject("security-167");
@@ -80,19 +72,11 @@ public class AbstractItemSecurityTest {
 
     @Issue("SECURITY-167")
     @Test()
-    public void testhamyXmlIDoesNotFail() throws Exception {
+    public void testUpdateByXmlDoesNotFail() throws Exception {
         final String xml = "<?xml version='1.0' encoding='UTF-8'?>\n" +
                 "<project>\n" +
-                "  <actions/>\n" +
                 "  <description>&amp;</description>\n" +
-                "  <keepDependencies>false</keepDependencies>\n" +
-                "  <properties/>\n" +
                 "  <scm class=\"hudson.scm.NullSCM\"/>\n" +
-                "  <canRoam>true</canRoam>\n" +
-                "  <triggers/>\n" +
-                "  <builders/>\n" +
-                "  <publishers/>\n" +
-                "  <buildWrappers/>\n" +
                 "</project>";
 
         FreeStyleProject project = jenkinsRule.createFreeStyleProject("security-167");
diff --git a/test/src/test/java/hudson/security/HudsonPrivateSecurityRealm2Test.java b/test/src/test/java/hudson/security/HudsonPrivateSecurityRealm2Test.java
index 5f49694154..25612464c3 100644
--- a/test/src/test/java/hudson/security/HudsonPrivateSecurityRealm2Test.java
+++ b/test/src/test/java/hudson/security/HudsonPrivateSecurityRealm2Test.java
@@ -1,3 +1,26 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2015, CloudBees, Inc
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
 package hudson.security;
 
 import com.gargoylesoftware.htmlunit.html.HtmlPage;
diff --git a/war/pom.xml b/war/pom.xml
index 2c60a83426..30ccd9d570 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -358,7 +358,13 @@ THE SOFTWARE.
                 <artifactItem>
                   <groupId>org.jenkins-ci.plugins</groupId>
                   <artifactId>matrix-project</artifactId>
-                  <version>1.3</version>
+                  <version>${matrix-project.version}</version>
+                  <type>hpi</type>
+                </artifactItem>
+                <artifactItem>
+                  <groupId>org.jenkins-ci.plugins</groupId>
+                  <artifactId>script-security</artifactId>
+                  <version>1.13</version>
                   <type>hpi</type>
                 </artifactItem>
                 <artifactItem>