Issue #2567257 by dawehner, stefan.r, effulgentsia, pwolanin, catch, Xano, mr.baileys, Wim Leers, k4v, Dave Reid, chx, googletorp, plach, lauriii, Berdir, webchick, alexpott, stefan.r: hook_tokens() $sanitize option incompatible with Html sanitisation requirements

Issue #2545972 by alexpott, joelpittet, ericjenkins, stefan.r, Wim Leers, Cottser: Remove all code usages SafeMarkup::checkPlain() and rely more on Twig autoescaping

Issue #2525910 by dawehner, effulgentsia, Berdir, lauriii, larowlan, timmillwood, Wim Leers, chx, arlinsandbulte, Fabianx, Gábor Hojtsy, Dave Reid, alexpott, catch: Ensure token replacements have cacheability + attachments metadata and that it is bubbled in any case

Issue #1392754 by tss, justAChris, jhodgdon: Comply with new documentation standards for @file for namespaced class files

Issue #2322195 by rpayanm, nlisgo, cilefen, balagan, LinL, akashjain132, filijonka, epari.siva, Tebro, Temoor, pcambra, unstatu, Poornima3, Shivam Agarwal, abhi170893, Dom., PieterJanPut, Mile23, JeroenT, disasm: Replace all instances of user_load(), user_load_multiple(), entity_load('user') and entity_load_multiple('user') with static method calls

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2322509 by prics, cilefen, gaurav.goyal, harijari, Temoor: Replace all instances of node_load(), node_load_multiple(), entity_load('node') and entity_load_multiple('node') with static method calls.

Issue #2340667 by YesCT, Pedro Lozano, alexpott, martin107: Protect Drupal\Core\Language\Language::id, and use getId().

Issue #2340123 by Wim Leers: Setting cache tags can be tricky: use strings instead of nested arrays to improve DX.

Issue #2246665 by jaredsmith, martin107, YesCT, filijonka, tstoeckler: Typehint with Drupal\Core\Language\LanguageInterface instead Drupal\Core\Language\Language.

Issue #2089433 by ianthomas_uk, grom358, herom, thedavidmeister, visabhishek, longwave, Sweetchuck: Remove uses of deprecated XSS filter functions.

Issue #2089461 by thedavidmeister, deneo, Alan D., longwave, dsdeiz, stpaultim: Convert all calls to check_plain() in core to Drupal\Component\Utility\String::checkPlain() in core/lib.