Issue #2388255 by dawehner, hussainweb, pwolanin: Limit PDO MySQL to executing single statements if PHP supports it

Issue #2221699 by mpdonadio, mikey_p, alexpott, kim.pepper, arlinsandbulte: HTTP_HOST header cannot be trusted

Revert "Issue #2221699 by mpdonadio, mikey_p, kim.pepper, arlinsandbulte: HTTP_HOST header cannot be trusted"

This reverts commit 2c9eddf3.

Issue #2221699 by mpdonadio, mikey_p, kim.pepper, arlinsandbulte: HTTP_HOST header cannot be trusted

Issue #2392319 by alexpott, effulgentsia: Config objects (but not config entities) should by default be immutable

Issue #2309737 by rpayanm, hussainweb, max-kuzomko, herom, millerbennett, ianthomas_uk, quietone, Sutharsan, sumitmadan, toddmbloom: Remove deprecated format_plural usage

Issue #2170235 by Berdir, penyaskito, larowlan, alexpott, sushyl: file_private_path should be in $settings, like file_public_path

Issue #2346287 by bserem, rteijeiro, Zekvyrin, alexpott: Fixed Installer requirements errors escaped HTML in variables.

Issue #2267551 follow-up by jfhovinne: [meta] Deal with PHP requirement vs. Debian PHP version numbering.

Issue #2267551 by jfhovinne, ParisLiakos, catch: PHP 5.4.5 needed to avoid zend failure when using autoloaded traits.

Issue #2277103 by tim.plunkett, pwolanin, Wim Leers, dawehner, hotpizzas: Switch Drupal::l() and LinkGenerator to expect a Url object.

Issue #2343651 by xjm, tim.plunkett, Wim Leers, dinarcon, dawehner: Remove most remaining l() calls.

Issue #2340251 by iMiksu, alexpott, tim.plunkett, dawehner, Wim Leers: Remove most remaining url() calls.

Issue #2333113 by effulgentsia, plach: Add an EntityDefinitionUpdateManager so that entity handlers can respond (e.g., by updating db schema) to code updates in a controlled way (e.g., from update.php).

Issue #2251113 by alexpott, damiankloip, Crell, Wim Leers, dawehner, sun: Use container parameters instead of settings.

Issue #2149197 by penyaskito, mikey_p, vijaycs85, herom: Replace format_interval with \Drupal::service('date')->formatInterval().

Issue #1825952 by Fabianx, joelpittet, bdragon, heddn, chx, xjm, pwolanin, mikey_p, ti2m, bfr, dags, cilefen, scor, mgifford: Turn on twig autoescape by default

Issue #2290261 by tim.plunkett, amool: Fixed Full configuration export crashing without the php_fileinfo extension.

Issue #2003800 by jhedstrom, filijonka, YesCT, ParisLiakos, steeloctopus, damiankloip, sun, LinL, amateescu: Move drupal_check_memory_limit() and parse_size() functionality to components.

Issue #2158571 by tstoeckler, dawehner, kgoel, tim.plunkett, catch, effulgentsia: Routes added in RouteSubscribers cannot be altered.

Issue #1067408 by alexpott, Jalandhar, jessebeach, Désiré, neetu morwani, dawehner, sun: Themes do not have an installation status.

Issue #2224777 by pwolanin, dawehner: Unlimited allowed length of path in menu router allows DoS attack on Drupal 8.

Issue #2140433 by pwolanin, chx, Owen Barton, dstol, Heine, Damien Tournoud: Port SA-CORE-2013-003 to Drupal 8.

Issue #2171683 by sun, alexpott, tstoeckler, larowlan: Remove all Simpletest overrides and rely on native multi-site functionality instead.

Revert "Issue #2171683 by sun, tstoeckler, larowlan: Remove all Simpletest overrides and rely on native multi-site functionality instead."

This reverts commit 91db25eb. Broke web
tests.

Issue #2171683 by sun, tstoeckler, larowlan: Remove all Simpletest overrides and rely on native multi-site functionality instead.

Issue #2182423 by Berdir, joelpittet: Key_value_expire doesn't get reset and balloons the PDO execution time for form pages.