Endpoints

HTTP/2 can be enabled in standalone mode. (H2 requires Java 9, but H2C works in Java 8.)
The accept queue limit of the standalone HTTP & HTTPS servers is configurable.
The minimum size in IIIF Image API 2.x info.json responses is configurable. (Thanks to @cbeer)
The maximum size in IIIF Image API 2.x info.json responses is the full image size, rather than half size. (Thanks to @cbeer)
The IIIF Image API 1.x endpoint returns a JPEG image, rather than GIF, when no client preference is expressed in the URI or Accept header.
Certain derivative cache errors can be recovered from without causing an error response.
The sizes key in Image API 2.x information responses respects the max_pixels configuration option.
Image and information endpoints return 501 Not Implemented, rather than 500 Internal Server Error, when the selected processor does not support the requested source format.
Image requests may include a ?response-content-disposition query argument to suggest a response Content-Disposition header value.
Added several HTTP API methods for cache management.
Changes to HTTP Basic authorization settings in all endpoints take effect without restarting.
All endpoints support the HTTP OPTIONS method.
Status items in the Control Panel update automatically via AJAX.
The username used to access the Control Panel is configurable.

Resolvers

Miscellaneous efficiency improvements across all resolvers.
The HttpResolver::get_url() delegate method may return a hash containing authentication credentials.
Added an option to HttpResolver to trust all certificates.
The request timeout of HttpResolver is configurable.
AmazonS3Resolver and AzureStorageResolver attempt to infer a source format from the object/blob key if not able to do so from the identifier or from object/blob metadata.
The maxmimum number of AWS connections used by AmazonS3Resolver is configurable.
AmazonS3Resolver falls back to obtaining credentials from various other sources (see the user manual) when they are not set in the configuration file. (Thanks to @jweisman)
Resolver delegates are passed an additional context argument. (Thanks to @jonathangreen)

Added an option that enables Java2dProcessor, JaiProcessor, KakaduProcessor, and PdfBoxProcessor to preserve the sample depth of >8-bits-per-sample source images.
GraphicsMagickProcessor and ImageMagickProcessor respect the processor.dpi configuration key.
GraphicsMagickProcessor supports the GIF output format.
ImageMagickProcessor supports image overlays.
FfmpegProcessor supports FLV videos.
The processor.background_color configuration key affects alpha blending as well as non-90°-multiple rotations. (Thanks to @Algae666)
ImageMagickProcessor's support for ImageMagick versions prior to 7 is deprecated.
OpenJpegProcessor's support for OpenJPEG versions prior to 2.2.0 is deprecated.
Improved the predictability of ImageIO plugin selection.
Initialization warnings (related to missing dependencies, for example) are displayed in the Control Panel.

Image info is written to caches asynchronously to enable faster responses.
Added an optional in-memory image info cache.
Added RedisCache.
Added HeapCache.
AmazonS3Cache uploads images to S3 asynchronously, enabling faster responses.
The maxmimum number of AWS connections used by AmazonS3Cache is configurable.
AmazonS3Cache falls back to obtaining credentials from various other sources (see the user manual) when they are not set in the config file. (Thanks to @jweisman)
On macOS, FilesystemCache uses file last-modified times rather than last-accessed times as the latter are not reliable.