the following changes have been pushed to bugzilla.mozilla.org:
-  Documentation about possible_duplicates() lists ‘products’ as argument instead of ‘product’
-  Bugzilla crashes when the shutdownhtml parameter is set and using a non-cookie based authentication method
-  backport upstream bug 756048 to bmo/4.2 to allow setting bug/attachment flags using the webservices
-  backport upstream bug 952284 to bmo/4.2 to hide tags set to private comments in the bug activity table
-  backport upstream bug 945535 to bmo/4.2 for performance improvement in bugs with large number of attachments
discuss these changes on mozilla.tools.bmo.