In reply to Jeff Chandler.

Any site that uses any custom code at all would break every time an update occurs. Having to patch and re-patch file on each update (one per month on average) is a huge waste of time.

Yes, modifying core files is strongly not recommended, and the desired result can generally be achieved in other ways.

A security fix should be a security fix, period. It should provide only the files that need to get fixed, and should be applied. There should be no change in functionality unless there is an exceptional circumstance where a function is itself the security issue.

That's exactly how background updates for previous branches currently work.

One of the issues for me is a lack of “hooks”, places where code can be easily added to the most basic of files.

If there are hooks missing in some particular files, could you create a Trac ticket and describe your use case and the changes you have to make in detail?

I'm sure either the hooks would eventually be added or a more appropriate solution would be suggested.