Issue #2458349 by Wim Leers: Route's access result's cacheability not applied to the response's cacheability

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2451665 by dawehner: Don't rebuild the route on ModuleInstaller::install() (30% installer speedup)

Issue #2455083 by dawehner, larowlan, klausi, David_Rothstein, hefox, tsphethean, dstol, DamienMcKenna, Pere Orga, benjy: Open redirect fixes from SA-CORE-2015-001 need to be ported to Drupal 8

Issue #2286971 by znerol, Berdir, almaudoh, cilefen: Remove dependency of current_user on request and authentication manager

Issue #356399 by dawehner, beejeebus, catch, sidharrell, klausi, nlisgo, Josh Waihi, Berdir, martin107: Optimize the route rebuilding process to rebuild on write

Issue #2358079 by pwolanin, Berdir: Require a specific placeholder format in db_query() in order to trigger argument expansion, and require explicit 'IN' parameter for conditions

Issue #2364157 by mpdonadio, dawehner, martin107, Berdir, pcambra, naveenvalecha, tim.plunkett: Replace most existing _url calls with Url objects

Issue #2350837 by dawehner, Berdir, larowlan, Wim Leers: Convert most usages of EntityInterface::getSystemPath() to use routes

Issue #2358369 by balagan, Katiemouse: getParameters() vs. getRawParameters() on RouteMatch should not be documented the same

Issue #2281619 by dawehner, tim.plunkett: Convert most direct usages within module code of routing related request attributes to use RouteMatchInterface instead

Issue #2362227 by dawehner, mpdonadio, znerol, tim.plunkett, skipyT: Replace all instances of current_path()

Issue #2288911 by znerol, effulgentsia: Use route name instead of system path in user maintenance mode subscriber

Issue #2351777 by chx, claudiu.cristea: Do not depend on event subscribers for security: Replace AccessRouteSubscriber with build-in checks.

Issue #2230091 by dawehner, Berdir, marthinal, martin107: Fixed Route rebuilding is not guaranteed to finish in time for the next request.

Issue #2345753 by tim.plunkett, dawehner, Wim Leers, damiankloip: Remove url(current_path()) and url(NULL) with <current> and <none>.

Issue #2347831 by xjm, effulgentsia: Fix documentation for \Drupal::url(), \Drupal::l(), etc. (and fix the change record).

Issue #2343661 by larowlan, tim.plunkett | xjm: Rename l() to _l() and url() to _url(), and document replacements.

Issue #2277103 by tim.plunkett, pwolanin, Wim Leers, dawehner, hotpizzas: Switch Drupal::l() and LinkGenerator to expect a Url object.

Issue #2340251 by iMiksu, alexpott, tim.plunkett, dawehner, Wim Leers: Remove most remaining url() calls.