Issue #2847553 by poker10, Jill L, David_Rothstein: XSS attribute handling mangles valid attribute names containing numbers (D7 backport)

Issue #998632 by dalin, poker10: drupal_write_record() throws PHP notices if any fields use DB-specific data types

Issue #2966195 by mpaler, poker10, ravi.shankar, chrisolof, klonos: valid_email_address() should be easily overridable

Issue #3308929 by poker10, swentel, fago, catch, alexpott, Berdir: [D7] Cron lock time limit is too short and does not prevent multiple, concurrent cron runs

Issue #3293649 by mcdruid: drupal_http_request() fails to strip Cookie or Authorization headers on HTTP downgrade

Issue #2884171 by mcdruid, Seth Snyder: The drupal_render() function could use a bit more protection

Issue #2819535 by mcdruid, Kingdutch, SumeetJaggi, cafuego, liannario, David_Rothstein, Diego_Mow, Fabianx: x-content-type-options nosniff ignored for anonymous cached pages

Issue #3270546 by mcdruid, poker10, mfb: PHP 8.1 str_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated in filter_xss()

Issue #3166668 by akhilavnair, arx-e, poker10, mcdruid, igorbarato, Fabianx: PHP 7.4 and empty entity_keys for taxonomy term result in notices

Issue #3247935 by mfb: drupal_add_html_head_link(): URL in link HTTP header should not be HTML-encoded

Issue #229825 by nod_, mcdruid, sun, ApacheEx, lightsurge, legovaer, pounard, RobLoach, Frederikvho, Robin Monks, cburschka, yched, keith.smith, Kiphaas7, treksler, jbrauer, catch, Dave Reid, aspilicious, Damien Tournoud, Wim Leers, giupenni, ressa, Fabianx, webchick: backport "$_COOKIE['has_js'] must die" patch to 7.x

Issue #3165377 by MaxMendez, Eugene Bocharov, joseph.olstad, MustangGB: element_property() causes a notice in 7.4 if $key is an integer

Issue #2959727 by mfb, mcdruid, ejanus, msankhala, Fabianx: drupal_add_html_head_link() needs to allow multiple hreflang tags to point to one URL

Issue #3006123 by joelpittet: D7 drupal_array_get_nested_value() array_key_exists() micro-optimization

Issue #2877131 by collinhaines, Liam Morland, sjerdo, hass, oadaeh, gnuget, johns996, gapple, aerozeppelin, mgifford, alexpott: CSS aggregation strips some essential whitespace within strings

Issue #3209976 by mcdruid, DamienMcKenna, Maeglin, antiorario, effulgentsia, gapple, rachel_norfolk, rootwork, phenaproxima, neclimdul, larowlan, longwave: Add Permissions-Policy header to block Google FLoC

SA-CORE-2021-002 by Jasu_M, effulgentsia, alexpott, mlhess, Wim Leers, Heine, pwolanin, xjm, samuel.mortenson, nwellnhof, larowlan, phenaproxima, mcrdruid

Issue #2842762 by Liam Morland, cafuego, jenlampton, ZenDoodles: Call to undefined function drupal_get_path_alias() in url()

Issue #2400287 by hass, cutesquirrel, borisson_, rteijeiro, aerozeppelin, yuriy.babenko, cyb.tachyon, pfrenssen, deanflory, webchick, David_Rothstein, cilefen, aspilicious, netbek, stefan.r, moshe weitzman, nod_, minakshiPh, pandaski: Remove all occurences of sourceMappingURL and sourceURL when JS files are aggregated

Issue #3008166 by joseph.olstad, alexpott, catch, cilefen, xjm: Unnecessary looping in filter_xss() when processing attributes

Issue #2756297 by hgoto, David_Rothstein, mcdruid, izmeez, pcambra, joseph.olstad, MustangGB, Fabianx, stefan.r, catch, kiamlaluno: element_children sort order inconsistent between PHP 5 and PHP 7

Issue #3084953 by Taran2L, kiamlaluno: Trying to access array offset on value of type null in _drupal_build_css_path()

Issue #3084935 by mcdruid, kiamlaluno, Taran2L, atheia, Liam Morland: Trying to access array offset on value of type int in element_children() and DrupalRequestSanitizer::stripDangerousValues()

Revert "Issue #3084935 by kiamlaluno, Taran2L, mcdruid, atheia, Liam Morland: element_children() and DrupalRequestSanitizer::stripDangerousValues() should not use integers as an array"

This reverts commit edb77684.

Issue #3084943 by longwave, Taran2L: Pass parameters as implode($glue, $pieces); reverse order is deprecated

Issue #3084935 by kiamlaluno, Taran2L, mcdruid, atheia, Liam Morland: element_children() and DrupalRequestSanitizer::stripDangerousValues() should not use integers as an array

Pol Dellaiera authored May 07, 2019 and Fabian Franz committed May 10, 2019

Issue #3051370 by Pol, markcarver, Fabianx: Create "scripts" element to align rendering workflow to how "styles" are handled

Revert "Issue #3051370 by Pol, Fabianx: Create "scripts" element to align rendering workflow to how "styles" are handled"

This reverts commit 5f67268e.