Issue #2458349 by Wim Leers: Route's access result's cacheability not applied to the response's cacheability

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2451665 by dawehner: Don't rebuild the route on ModuleInstaller::install() (30% installer speedup)

Issue #2372011 by richardcanoe, Noe_: NotFoundHttpException handler should take into account it's parameters

Issue #2455083 by dawehner, larowlan, klausi, David_Rothstein, hefox, tsphethean, dstol, DamienMcKenna, Pere Orga, benjy: Open redirect fixes from SA-CORE-2015-001 need to be ported to Drupal 8

Issue #356399 by dawehner, beejeebus, catch, sidharrell, klausi, nlisgo, Josh Waihi, Berdir, martin107: Optimize the route rebuilding process to rebuild on write

Issue #2431053 by zealfire, epari.siva, dawehner: RouteProviderTest::testRouteByName should be public

Issue #2050759 by tim.plunkett, fietserwin: Move drupal_chmod and other code in file.inc to a Drupal\Core\File\FileSystem class

Issue #462950 by pwolanin: Mitigate the security risks that come from IE and other browsers trying to sniff the mime type

Issue #2395395 by alexpott, effulgentsia, Gábor Hojtsy: TestBase lacks a config method to be used consistently in tests

Issue #2324055 by dawehner, cilefen, znerol: Split up the module manager into runtime information and extension information

Issue #2362517 by Wim Leers: Improve default 403/404 exception HTML subscriber: don't duplicate the page render pipeline, use the routing system — add system.403 and system.404 routes.

Issue #2316537 by dawehner | chx: Upgrade symfony CMF to 1.2, remove deprecated parameters from getRouteByName* .

Issue #697760 by sun: Replace getInfo() in tests with native phpDoc + annotations (following PHPUnit).