Issue #2966327 by alexpott, mcdruid, dww, dsnopek, catch, pwolanin, larowlan, tim.plunkett, Berdir, Sam152: Limit what can be called by a callback in render arrays to reduce the risk of RCE

Issue #2854529 by alexpott, xjm, klausi, Chi, Mixologic: Fix Drupal.Scope.MethodScope - all methods should have scopes

Issue #2569119 by pwolanin, marvin_B8, jhedstrom, csheltonlcm, alexpott, dawehner, Fabianx, catch:  Use Crypt::hashBase64(), not hash('crc32b') or sha1 for placeholder tokens

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

Issue #2335661 by Wim Leers, pwolanin, dawehner, Fabianx, larowlan, catch, Berdir: Outbound path & route processors must specify cacheability metadata

Issue #2293501 by dawehner, Wim Leers, znerol: Use route name and params instead of _system_path in CsrfAccessCheck.

Issue #2109303 by damiankloip, ParisLiakos: Convert CSRF checks in controllers to the routing system.

Issue #1798296 by damiankloip, Xano, David_Rothstein, Crell, dawehner: Integrate CSRF link token directly into routing system.