Issue #2569293 by lauriii, alexpott, dawehner: Replace remaining !placeholder for Non-URL HTML outputs only in code Table.php

Issue #2560863 by alexpott, stefan.r, lauriii: #options for radios and checkboxes uses SafeMarkup::checkPlain() to escape - use Html::escape() instead

Issue #2506445 by joelpittet, Ryan Weal, Sutharsan, alexpott, subhojit777, justAChris, nlisgo, effulgentsia, rpayanm, larowlan, chx, xjm, dawehner, geertvd, lauriii, izus, andypost, borisson_, Sharique: Replace !placeholder with @placeholder in t() and format_string() for non-URLs in tests

Issue #2512306 by StryKaizer, bojanz, googletorp, JeroenT, borisson_, tim.plunkett: Inline errors not shown for details elements

Issue #1617918 by pfrenssen, tea.time: Test that no validation errors occur for anonymous users when $form['#token'] == FALSE

Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk, olli: Remove all usages SafeMarkup::checkPlain() from render arrays

Revert "Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk: Remove all usages SafeMarkup::checkPlain() from render arrays"

This reverts commit 31007609.

Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk: Remove all usages SafeMarkup::checkPlain() from render arrays

Issue #1611954 by tim.plunkett, sun, samuel.mortenson, Berdir, mgifford, chx: Setting #access = FALSE on a vertical tab does not prevent input processing of the contained form elements

Issue #2559605 by Cottser, stefan.r: Convert SafeMarkup::checkPlain() in render arrays to #plain_text

Issue #2554233 by pwolanin, tim.plunkett, amateescu, dawehner, Wim Leers, catch, effulgentsia, larowlan, Abdullah Hussam, greggles, David_Rothstein: Port Cross-site Request Forgery - Form API fixes from SA-CORE-2015-003 to Drupal 8

Issue #2557519 by alexpott, joelpittet: Remove many usages SafeMarkup::checkPlain() and replace with Html::escape()

Issue #2502785 by dawehner, effulgentsia, tim.plunkett, amateescu, Fabianx, Wim Leers, catch, dsnopek, EclipseGc, yched, Berdir, larowlan, mondrake, olli: Remove support for $form_state->setCached() for GET requests

Issue #1392754 by tss, justAChris, jhodgdon: Comply with new documentation standards for @file for namespaced class files

Issue #2375689 by Arla, Wim Leers, dawehner, tim.plunkett, Berdir: BlockBase::blockAccess() should return AccessResult instead of a bool

Issue #2463321 by amateescu: Serializing the database connection is dangerous and error-prone, make it unserializable again

Issue #2459971 by Gábor Hojtsy: The langcode key on configuration files is not explicit in configuration schema

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2426181 by effulgentsia, mpdonadio, xjm: Add a Url::fromUserInput() wrapper method for generating URLs from user-entered paths

Issue #2417647 by Wim Leers, effulgentsia: Add leading slash to paths within 'user-path:' URIs, to allow 'user-path:' URIs to point to the <none> route

Issue #2417333 by Wim Leers, pwolanin, xjm, dawehner: Add support for user-path: scheme to Url class

Issue #2392319 by alexpott, effulgentsia: Config objects (but not config entities) should by default be immutable

Issue #2281619 by dawehner, tim.plunkett: Convert most direct usages within module code of routing related request attributes to use RouteMatchInterface instead

Issue #2242749 by znerol, torotil, rszrama, larowlan, dawehner, penyaskito, tim.plunkett, sun, Damien Tournoud, David_Rothstein,  effulgentsia: Fixed Port Form API security fix SA-CORE-2014-002 to Drupal 8.

Issue #2347465 by tim.plunkett, dawehner, cilefen: Convert all instances of #type link/links to convert to use routes.

Issue #2343759 by pwolanin, larowlan, dawehner, tim.plunkett, effulgentsia, xjm, Wim Leers: Provide an API function to replace url()/l() for external urls.

Issue #2328411 by dawehner, geerlingguy, herom: Convert all permissions to yml files and permission callbacks.