Issue #3420076 by klausi, poker10: _drupal_log_error() should return a non-zero exit code on errors in the cli

Issue #2180877 by poker10, ClassicCut, juankvillegas: file_validate_image_resolution() doesn't recalculate the image dimensions after checking $maximum_dimensions

Issue #2847553 by poker10, Jill L, David_Rothstein: XSS attribute handling mangles valid attribute names containing numbers (D7 backport)

Issue #764408 by poker10, sgtpep, acrollet, David_Rothstein, checker, Fabianx, bkouchi: [D7] Drupal.t() does not respect locale_custom_strings

Issue #3396440 by poker10, joelpittet, tibezh, Fabianx: [D7 PHP 8.1] html_entity_decode(): Passing null to parameter #1 ($string) of type string is deprecated in decode_entities()

Issue #2345695 by poker10, formatC'vt, frodri, quietone, mgifford, mondrake, thirdender, james.williams: Users are able to upload 0-byte images

Issue #808416 by lostchord, gaurav.kapoor, daniels220, JacobSanford, jp.stacey, er.pushpinderrana, jhodgdon, oriol_e9g, kiwimind, Damien Tournoud, Gábor Hojtsy, poker10, Dries: Document that clock drift will cause lock system to fail

Issue #2540830 by swarad07, mikemadison, jhodgdon, poker10, David_Rothstein, cilefen: Sanitize watchdog() link in dblog_event()

Issue #1705618 by sun, nod_, mgifford, hanoii, clemens.tolboom, poker10, torotil, Wim Leers, Matt V., helmo, mcdruid, joseph.olstad, JvE, tim.plunkett, Bojhan, fawwad.nirvana, GuyPaddock, Dries, David_Rothstein: Double click prevention on form submission

Issue #2164025 by skipyT, mcdruid, pwolanin: Improve security of session ID against DB exposure or SQL injection

Issue #3214047 by poker10, mcdruid: [D7] Add phtml files to the list of potentially malicious extensions

Issue #998632 by dalin, poker10: drupal_write_record() throws PHP notices if any fields use DB-specific data types

Issue #3019792 by apaderno, poker10: The description for the value returned from form_type_token_value() is wrong

Issue #2550519 by pwolanin, klausi, nullkernel, cweagans, Heine, alexpott, sindurig, YesCT, Ayesh, neclimdul, mfb, zniki.ru, eugene.ilyin, David_Rothstein, catch, joseph.olstad, dawehner, izmeez, chx, sarciszewski, stefan.r, apaderno, Fabianx, poker10: drupal_random_bytes() should use random_bytes() if available

Issue #2733299 by jacob.embree, mikhailkrainiuk: Documentation and behavior mismatch in form_get_errors

SA-CORE-2023-005 by benjifisher, Heine, cmlara, mlhess, larowlan, David_Rothstein, xjm, Wim Leers, DamienMcKenna, effulgentsia, pwolanin, mcdruid, poker10, jenlampton, longwave, kim.pepper, alexpott, drumm

Issue #2966195 by mpaler, poker10, ravi.shankar, chrisolof, klonos: valid_email_address() should be easily overridable

Issue #3308929 by poker10, swentel, fago, catch, alexpott, Berdir: [D7] Cron lock time limit is too short and does not prevent multiple, concurrent cron runs

Issue #3284269 by mcdruid, poker10: Fix samesite attribute on Drupal.toolbar.collapsed and other similar cookies