• Widgets API The new widgets API lets you create widgets by extending the WP_Widget class. If making a multi-widget with the old system was like trying to piece together your kid’s bicycle on Christmas Eve, the new API rolls out the bike for you, tires inflated and topped with a bow.
• SimplePie RSS WordPress has been using the MagpieRSS class to parse RSS feeds. Trouble is, Magpie development ground to a halt about four years ago, meaning when contemporary feeds flummoxed Magpie, flustered developers fumed, futilely. In 2.8, WordPress now reads RSS with SimplePie, an active project with a robust API.
• New Escape Functions A new set of functions consistently named and DRY-er now make your strings sparkly clean and cuddly safe.
  • esc_sql(): A wrapper for the $wpdb->escape() method.
  • esc_url(): Clean up an untrustworthy URL for printing.
  • esc_url_raw(): Clean up an untrustworthy URL for storing in the database.
  • esc_js(): Make text suitable for printing as a JavaScript string.
  • esc_html(): Convert characters that have special meaning in HTML (such as > and <) into their equivalent character entities.
  • esc_attr(): Prepare text so that it’s safe to be used in an HTML element attribute.
  • esc_attr__(), esc_attr_e(), and esc_attr_x(): Make a translatable string safe for printing as an HTML element attribute. E.g., <a href="" title="<?php esc_attr_e('Translate me'); ?>">
  • esc_html__() and esc_html_e(): Like the last two, but for escaping HTML characters in general.
• get_the_author_meta() User data is spread out between two database tables and has been accessed—until now—by a number of methods. get_the_author_meta() retrieves user data with one easy-to-remember function.
• the_post Action Hook Called in setup_postdata(), the the_post action hook is one of those things that seems so obvious and so useful that you can’t believe it hasn’t existed until now. At a crucial moment it passes the current global $post variable by reference: during the Loop right after global variables are set but before they’re used in the template.

Keep in mind that WordPress 2.7 is still under development, and these features could change somewhat before 2.7 is released.

• WordPress no longer allows you the option to compress your pages using gzip. Apparently gzip created problems for some people, and there are better server-side ways of doing this. However, I thought it was a simple way to reduce bandwidth and improve page load times, so for those interested, I created a plugin that restores the gzip feature.
• The persistent object cache has been removed. This means that no longer can you enable file-based object caching by putting define('ENABLE_CACHE', true); in your wp-config.php file.

  The object cache is still there, and you can take advantage of it with various plugins for PHP caching methods, such as APC, eAccelerator, XCache, and Memcached. As far as I know, no one has yet written a plugin to replace the file-based object caching that has been removed. Mahmoud Al-Qudsi mentions in the comments a new plugin to use file-based caching in WordPress 2.5.

• The meta “generator” tag that many themes have in their headers—you know, the one that says <meta name="generator" content="WordPress 2.3.3" />—is now added to the header via the “wp_head” filter. You need to know this for one of two reasons: if your theme (like most) prints the generator tag already, when you upgrade to 2.5 you’ll be printing it twice. More importantly, if you’re one of those people who hides the generator tag (for perceived security reasons), you’ll now have to remove the action call explicitly. remove_action('wp_head', 'wp_generator'); will do it for the header but not RSS feeds.
• Imports using WordPress WXR files will now import your attachments. This is a really handy feature, as before moving images from one blog to another usually required a FTP client and often messed up the attachment browsing in the new blog.
• New password hashing. Until WordPress 2.5, WordPress hashed passwords with a simple double md5 method. Because of security problems that could occur should someone obtain a copy of your database, password hashing was overhauled. If you’ve integrated WordPress users with another application and are counting on the double-md5 method, you may want to download this plugin that reverts to the system.

And that’s a lot of bugs, as much of the admin redesign hasn’t yet been completed by lead developer Matt Mullenweg, who is single-handedly doing the styling redesign.

Because of the feature-freeze, here are some features you won’t be seeing in WordPress 2.5:

• A general meta-data table, my proposal for providing a better way to deal with things like comment meta data and plugin info.
• Localized plugin metadata. Currently, plugins’ descriptions, names, etc., cannot be translated to the user’s language. The problem doesn’t have a trivial solution, so it was pushed off for the future.
• Automatic WordPress upgrades. The idea is for users to click a button in the WordPress dashboard and upgrade to the latest version of WordPress. Although this didn’t make it in, automatic upgrades for themes and plugins is in 2.5 for now, with the possibility of being yanked out should it prove too buggy.
• Ajaxy page rearranging. This was actually one of the 2007 WordPress Google Summer of Code projects, but like all (as far as I know) of the other SoC projects has not been implemented.
• Word count. This seems to me like something that should be restricted to a plugin, but as it’s part of WordPress.com and was proposed by a core developer, it seemed destined to become a feature.
• User roles overhaul. User capabilities have a number of problems (for example, you can’t easily sort a massive database of users by role). So far the proposed workarounds have their own problems.
• Plugin uninstall hook. There are plugin activation and deactivation events, but no plugin uninstallation events. The idea, pushed recently by Jeffro2pt0 on WeblogToolsCollection, is something that would clear out the unused data left around by unused plugins (depending on the plugin. This can be extensive, from numerous options values—slowing down unrelated queries—to entire database tables.

You can see a proof of concept here.

UPDATE: WordPress 2.3.3 has been released, so I recommend that you upgrade as soon as possible.