Issue #2938053 by Wim Leers, alexpott: AccessResult::orIf() fails to retain the reason if both operands are neutral or forbidden, but the first contains a reason and the second one does not

Issue #2853503 by Aki Tendo, alexpott, larowlan, Wim Leers, klausi, fgm, dawehner, mondrake, catch, Berdir, neclimdul, borisson_: Remove all assert('string') calls from Drupal core because deprecated in PHP 7.2

Issue #2902726 by mfernea, martin107: Fix 'Drupal.Commenting.FunctionComment.ParamCommentNotCapital' coding standard

Issue #2854529 by alexpott, xjm, klausi, Chi, Mixologic: Fix Drupal.Scope.MethodScope - all methods should have scopes

Issue #2776975 by joelpittet, dawehner, tim.plunkett, xjm, pfrenssen: March 3, 2017: Convert core to array syntax coding standards for Drupal 8.3.x RC phase

Issue #2808233 by gnuget, dawehner, Wim Leers, tedbow, Chi, dysrama: REST 403 responses don't tell the user *why* access is not granted: requires deep Drupal understanding to figure out

Issue #2569119 by pwolanin, marvin_B8, jhedstrom, csheltonlcm, alexpott, dawehner, Fabianx, catch:  Use Crypt::hashBase64(), not hash('crc32b') or sha1 for placeholder tokens

Issue #2826391 by Wim Leers: CsrfAccessCheck should have proper error feedback for invalid/missing CSRF token query argument just like CsrfRequestHeaderAccessCheck

Issue #2795965 by Wim Leers, neclimdul: REST requests with invalid X-CSRF-Token header get "missing " mesage

Issue #2785991 by blazey, dawehner: Unnecessary call to AccessResult::neutral() in Drupal\Core\Access\AccessManager::check()

Issue #2681911 by garphy, Wim Leers, gabesullice: REST requests without X-CSRF-Token header: unhelpful response significantly hinders DX, should receive a 401 response

Issue #2753681 by tedbow, Wim Leers, dawehner, neclimdul, catch: Move CSRF header token out of REST module so that user module can use it, as well as any contrib module

Issue #2719695 by alexpott, Mile23: Fix 'Drupal.Classes.ClassDeclaration.CloseBraceAfterBody' coding standard

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

(cherry picked from commit 96f86e68)

Issue #2599524 by blackra, krknth, jhodgdon, rhett.prichard: Fixing order of documentation sections for /core/lib/Drupal

Issue #2526326 by borisson_, Berdir, Wim Leers, Xano: Update CacheableMetadata & AccessResult to use RefinableCacheableDependency(Interface|Trait)

Issue #2524082 by pfrenssen, Gábor Hojtsy, Wim Leers, Berdir, Fabianx, dawehner, catch: Config overrides should provide cacheability metadata

Issue #2512718 by Berdir, pfrenssen, Wim Leers, Fabianx, dawehner, catch, effulgentsia, plach, Gábor Hojtsy: EntityManager::getTranslationFromContext() should add the content language cache context to the entity

Issue #1392754 by tss, justAChris, jhodgdon: Comply with new documentation standards for @file for namespaced class files

Issue #2483781 by borisson_, rbayliss, cilefen, mitalimehta, joshi.rohit100: Move cache contexts classes from \Drupal\Core\Cache to \Drupal\Core\Cache\Context

Issue #2478119 by znerol, andypost: Replace references to Session Manager with references to Session

Issue #2335661 by Wim Leers, pwolanin, dawehner, Fabianx, larowlan, catch, Berdir: Outbound path & route processors must specify cacheability metadata

Issue #2099137 by Wim Leers, amateescu, rteijeiro, larowlan, effulgentsia: Entity/field access and node grants not taken into account with core cache contexts

Issue #2468151 by lhangea, rpayanm, Palashvijay4O: Rename the CacheContexts service to CacheContextsManager

Issue #2444231 by Wim Leers, nlisgo: Fix CacheableInterface so it makes sense (was: "Make Config objects & Entities implement CacheableInterface + add BubbleableMetadata::createFromCacheableObject()")

Issue #2428703 by Wim Leers: Add a 'user.permissions' cache context (was: "Should cache contexts be able to associate a cache tag?")

Issue #2443073 by Wim Leers, joshtaylor: Add #cache[max-age] to disable caching and bubble the max-age

Issue #2329101 by Wim Leers: CacheableInterface only has a getCacheKeys() method, no getCacheContexts(), leads to awkward implementations

Issue #2417793 by effulgentsia, Wim Leers, YesCT, yched, dawehner: Allow entity: URIs to be entered in link fields

Issue #2040135 by Wim Leers, Berdir: Caches dependent on simple config are only invalidated on form submissions