Issue #3363423 by _shY, vbouchet: Use CallableResolver for \Drupal\Core\Access\CustomAccessCheck::access()

Issue #2786941 by sadashiv, roshnichordiya, neclimdul, kishor_kolekar, dawehner, gnuget, Abhijith S, wengerk, firfin, froboy, pbuyle: Simplified custom access checker does not have access to Request

Issue #3358044 by solideogloria, longwave: Fix parameter type hint order in AccessResultReasonInterface and FileListingTest

Issue #3347067 by danflanagan8, _pratik_, smustgrave, longwave: CsrfAccessCheck docblock extremely out of date

Issue #3087868 by Charlie ChX Negyesi, Wim Leers, joachim, smustgrave: Make the AccessResult API even clearer

Issue #3115308 by andypost, ankithashetty, paulocs, longwave: Remove _access_rest_csrf route requirement

Issue #2949457 by idebr, jibran, Wim Leers, dungahk, fago, kim.pepper, neclimdul, ravi.shankar, Suresh Prabhu Parkala, Sam152, joshua1234511, Kristen Pol, kualee, MiroslavBanov, acbramley, alexpott, Fabianx: Enhance Toolbar's subtree caching so that menu links with CSRF token do not need one subtree cache item per session

Issue #3106216 by Spokje, longwave, alexpott, apaderno, Hardik_Patel_12, daffie: Remove unused variables from core

Issue #3210129 by quietone, murilohp, xjm: Fix spelling for words used once, beginning with 'a' -> 'd', inclusive

Issue #3207567 by Spokje, quietone, guilhermevp, yogeshmpawar, daffie, alexpott: Fix Drupal.Commenting.FunctionComment.MissingParamComment

Issue #3209619 by longwave, daffie, catch: [Symfony 6] Passing null as $message to Symfony exception constructors is deprecated, pass an empty string instead

Issue #3183036 by claudiu.cristea, jibran, Berdir: Don't instantiate access checkers not used by any route

Issue #2851394 by GoZ, hgunicamp, oknate, jungle, wolffereast, tameeshb, mmatsoo, ridhimaabrol24, jofitz, swarad07, tanc, shaktik, dimaro, shashikant_chauhan, MerryHamster, quietone, nitesh624, martin_q, boaloysius, gaurav.kapoor, nitvirus, ankithashetty, Munavijayalakshmi, kostyashupenko, leolando.tan, amit.drupal, ravi.shankar, akashkrishnan01, Swapnil_Kotwal, Saviktor, mrinalini9, anmolgoyal74, Venkatesh Rajan.J, shimpy, lomasr, Dinesh18, shubham.prakash, mahtab_alam, markdorison, cilefen, longwave, bleen, xjm, alexpott, gmaltoni: Fix grammar 'a' to 'an' when necessary

Issue #3156880 by alexpott, Gábor Hojtsy, andypost, hussainweb: \Drupal\Core\Access\CsrfTokenGenerator::validate() - ensure $token is a string before calling hash_equals()

Issue #2917331 by catch, martin107, Deepak Goyal, longwave, andypost, ravi.shankar, alexpott, daffie, larowlan: Decouple from Symfony CMF

Revert "Issue #2917331 by catch, martin107, Deepak Goyal, longwave, andypost, ravi.shankar, daffie, larowlan: Decouple from Symfony CMF"

This reverts commit 98eed2b1.

Issue #2917331 by catch, martin107, Deepak Goyal, longwave, andypost, ravi.shankar, daffie, larowlan: Decouple from Symfony CMF

Issue #3110296 by Hardik_Patel_12, longwave, Berdir: Remove all @deprecated code from Drupal/Core/Access/

Issue #3102980 by Nathaniel, Hardik_Patel_12: AccessManager getRouteByName method signature parameters

Issue #3048498 by jonathan1055, Lendude, naveenvalecha, klausi, alexpott, Gábor Hojtsy: [≈Nov. 11] Fix Drupal.Commenting.Deprecated coding standard

Issue #3069028 by alexpott: Properly Deprecate Drupal\Core\Access\AccessResult::cacheUntilConfigurationChanges

Issue #2966327 by alexpott, mcdruid, dww, dsnopek, catch, pwolanin, larowlan, tim.plunkett, Berdir, Sam152: Limit what can be called by a callback in render arrays to reduce the risk of RCE

Issue #3053956 by alexpott, neeravbm, aleevas, voleger, Berdir: Deprecate \Drupal\Component\Utility\Crypt::hashEquals() in favour of PHP's builtin hash_equals()

Issue #2869426 by Wim Leers, dawehner, tstoeckler, alexpott, Berdir, larowlan: EntityResource should add _entity_access requirement to REST routes

Issue #3004281 by kiamlaluno, dhirendra.mishra, hardikpandya, borisson_: The description of the return value makes reference to a setting that doesn't exist anymore

Issue #2405241 by philipnorton42, jibran, dawehner, andrewmacpherson: Add helpful exception message in CustomAccessCheck

Issue #2937888 by dhruveshdtripathi, idebr, RoSk0, mohit1604, mfernea, borisson_: Fix 'Drupal.Commenting.DocComment.LongNotCapital' coding standard

Issue #2901730 by mfernea, ankitjain28may, idebr: Fix 'Squiz.WhiteSpace.FunctionSpacing' coding standard

Issue #2938053 by Wim Leers, alexpott: AccessResult::orIf() fails to retain the reason if both operands are neutral or forbidden, but the first contains a reason and the second one does not

Issue #2853503 by Aki Tendo, alexpott, larowlan, Wim Leers, klausi, fgm, dawehner, mondrake, catch, Berdir, neclimdul, borisson_: Remove all assert('string') calls from Drupal core because deprecated in PHP 7.2

Issue #2902726 by mfernea, martin107: Fix 'Drupal.Commenting.FunctionComment.ParamCommentNotCapital' coding standard

Issue #2854529 by alexpott, xjm, klausi, Chi, Mixologic: Fix Drupal.Scope.MethodScope - all methods should have scopes