Fifty-five changes: pluggable widgets become first-class MDL, a security command that never ran, and a run of check false positives only a real project exposed - #1052