The patches you mention are both for things outside core,
which is why they did not get applied before the
core release. When doing the release, the release criteria is to have no pri2 bugs outstanding on core, and that is burden enough in getting the release out.
If more people step forward to test and apply patches I
imagine more would get applied. I am not happy about
how many are still outstanding but on the other hand
it's a non-trivial amount of work to do it (often more work than the patch itself, eg with a
patch for a plpgsql function w/o a corresponding oracle fix or upgrade scripts).
Our track record with this stuff is reasonable in that there have been
508 patches submitted and 421 applied or refused (and many of
the current outstanding patches have problems but have not
been refused since the patch often points to the problem better than anything else). Oh, and some have been applied but not marked accepted since the person who applied it forgot to do so.
I think people who have been involved with OpenACS see that
the current release management has improved enormously (thanks almost entirely to Joel Aufrecht) and I don't think
making releases more burdensome is a reasonable thing to do
at this point.
That said, I would love it if more people stepped forward to test and apply patches...
