Issue #2776975 by joelpittet, dawehner, tim.plunkett, xjm, pfrenssen: March 3, 2017: Convert core to array syntax coding standards for Drupal 8.3.x RC phase

Issue #2567715 by marthinal, hgoto, jpd4nt, mr.baileys, Wim Leers, alexpott: #markup generated by #pre_render callbacks do not get processed by ensureMarkupIsSafe()

Issue #2719695 by alexpott, Mile23: Fix 'Drupal.Classes.ClassDeclaration.CloseBraceAfterBody' coding standard

Issue #2716685 by Mile23: Part 2: Fix several errors in the 'Drupal.Commenting.DocComment' coding standard

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

Issue #2609928 by micropat, cilefen, Cottser, chx: Xss::attributes() mangles valid attribute names containing numbers

Issue #2545972 by alexpott, joelpittet, ericjenkins, stefan.r, Wim Leers, Cottser: Remove all code usages SafeMarkup::checkPlain() and rely more on Twig autoescaping

Issue #2549791 by alexpott, Wim Leers: Remove SafeMarkup::xssFilter() and provide ability to define #markup escaping strategy and what tags to filter

Issue #2506195 by alexpott, joelpittet, xjm, David_Rothstein, Fabianx, pwolanin: Remove SafeMarkup::set() from Xss::filter()

Issue #2105841 by mr.baileys, Wim Leers, cs_shadow, sanduhrs, chx, webflo: Xss::filter() ignores malicious content in data-attributes and mangles image captions

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2315255 by Dave Reid: Fixed Xss::split() fails on custom HTML elements with dashes in the name.

Issue #1825952 by Fabianx, joelpittet, bdragon, heddn, chx, xjm, pwolanin, mikey_p, ti2m, bfr, dags, cilefen, scor, mgifford: Turn on twig autoescape by default

Issue #2099741 by Wim Leers, wwalc, mr.baileys, eaton, dstol, nod_, effulgentsia: Protect WYSIWYG Editors from XSS Without Destroying User Data.

Issue #2089461 by thedavidmeister, deneo, Alan D., dsdeiz, stpaultim: Convert all calls to check_plain() in core to Drupal\Component\Utility\String::checkPlain() in core/lib.

Issue #2010024 by damiankloip, dawehner, ParisLiakos: Move url related functions to a new Url component.

Issue #1998466 by dawehner, ParisLiakos: Convert filter_xss_admin() and similar function to an Xss component.