Issue #144538 by acbramley, tuutti, Damien Tournoud, alexpott, solideogloria, Xano, TwoD, damiankloip, smustgrave, pameeela, deviantintegral, L_VanDamme, daften, karishmaamin, g.oechsler, larowlan, klausi, sun, Fabianx, andypost, dawehner, kwinters, greggles, Wim Leers, grendzy, pwolanin, alexanderpas, drumm, Chi: User logout is vulnerable to CSRF

Issue #3324560 by alexpott, mstrelan, dimitriskr, xjm, longwave, catch: Replace strpos/substr with str_starts_with() / str_contains() / str_ends_with()

Issue #3427176 by mondrake, longwave: Replace calls to ::expectWarning*() from Drupal\Tests\Core\EventSubscriber\SpecialAttributesRouteSubscriberTest

Issue #3436468 by longwave, smustgrave, alexpott: AjaxResponseSubscriber should lazily instantiate AjaxResponseAttachmentsProcessor

Issue #3054821 by mr.baileys, wiifm, sime, angrytoast, pobster, smustgrave, RichardGaunt, alexpott, Wim Leers, quietone, Berdir, neclimdul, acbramley: Include Cache-Control header on 301 redirects

Issue #3436599 by longwave: Replace RequestCloseSubscriber with needs_destruction tag on ModuleHandler

Issue #1170362 by alexpott, catch, pillarsdotnet, sun, jofitz, geerlingguy, steinmb, tresti88, DamienMcKenna, dpovshed, imclean, bradjones1, mErilainen, David_Rothstein, KarenS, BTMash, rickmanelius, Anonymous, smustgrave, Wim Leers, kreynen, webchick, websiteworkspace, phenaproxima, Kiphaas7, bbrala: Install profile is disabled for lots of different reasons and core doesn't allow for that

Issue #3427740 by longwave: Remove KernelDestructionSubscriber, UpdateRegistryFactory and UpdateHookRegistryFactory

Issue #3419693 by mondrake, alexpott, smustgrave, catch: Log error instead of trigger_error in Drupal\Core\EventSubscriber\RedirectResponseSubscriber::checkRedirectUrl

Issue #2511308 by dimitriskr, ankithashetty, smustgrave, quietone, Wim Leers: Rename RendererInterface::renderPlain() to ::renderInIsolation()

Issue #2942001 by dimitriskr, alexpott, gaurav.kapoor, smustgrave, andypost, almaudoh: Deprecate ThemeHandlerInterface::rebuildThemeData() and use extension.list.theme service instead

Issue #3113971 by Spokje, mondrake, acbramley, phenaproxima, andypost, murilohp, mpdonadio, ravi.shankar, pavnish, pifagor, vladbo, JeroenT, voleger, Taran2L: Replace REQUEST_TIME in services

Issue #3412556 by catch, smustgrave, andypost, longwave: Allow needs_destruction services to run on page cache hits

Issue #3409587 by mfb, opsdemon, lostcarpark, longwave, cilefen, Lendude: [10.2 regression] RSS feeds invalid due to  

Issue #3410022 by heddn, larowlan, catch: Regression from #3295790 content-length header set earlier than expected

Issue #3038523 by cboyden, Gauravvvv, mgifford, Luke.Leber, Chi: Add aria-current attribute to navigation items

Issue #3214208 by gapple, Akhil Babu, larowlan, smustgrave: FinishResponseSubscriber could create duplicate headers

Issue #3402173 by sijumpk, Abhijith S, longwave, smustgrave: Remove @backtrace_string in ExceptionLoggingSubscriber::onClientError()

Issue #3377310 by catch, joelpittet, mark_fullmer, smustgrave, TrevorBradley, bkosborne, MWaters, cilefen, capellic: 400 exceptions result from requests for old asset paths which are missing the "theme" query string, possibly from cached pages

Issue #2828706 by smustgrave, Chi, saidatom, dagmar, dawehner, mfb, catch, larowlan, longwave, joshua1234511, Berdir, quietone, FeyP, slip, samiullah, johnwebdev, Primsi, ravi.shankar: ExceptionLoggingSubscriber should not log HTTP 4XX errors using PHP logger channel

Issue #3219513 by quietone, smustgrave, Vidushi Mehta, sourabhjain, rpayanm, longwave, xjm, dww, catch: Fix spelling for words used once, beginning with 'n' -> 'p', inclusive

Issue #2950883 by acbramley, smustgrave, akalam, phenaproxima, idebr, raman.b, alexpott, bsztreha, douggreen, Suresh Prabhu Parkala, ExTexan, Kristen Pol, joachim, lauriii: Allow form redirects to ignore ?destination query parameter

Issue #2921133 by quietone, VladimirAus, xjm, ankithashetty, longwave, Prem Suthar, smustgrave, benjifisher, AaronMcHale: Remove "Please" from the codebase

Issue #3295790 by bradjones1, mstrelan, rpayanm, catch, alexpott, acbramley, longwave, kim.pepper, mfb: Post-response task running (destructable services) are actually blocking; add test coverage and warn for common misconfiguration

Issue #3366287 by lauriii, catch, dmurphy1: [regression] Inserting media via the media library modal when paged redirects to the wrong destination

Issue #2932518 by kim.pepper, joachim, bradjones1, voleger, cliddell, gapple, Xano, andregp, andypost, neclimdul, rpayanm, Hardik_Patel_12, NWOM, smustgrave, dawehner, alexpott, daffie, larowlan, Berdir, mstrelan, xjm, dagmar: Deprecate watchdog_exception

Issue #2724829 by smustgrave, aneek, dww, saitanay, alexpott, quietone, larowlan, jungle: Maintenance Mode message is shown at multiple places on the page on Form API Ajax Callbacks

Revert "Issue #3219513 by smustgrave, quietone, sourabhjain, Vidushi Mehta, rpayanm, longwave, xjm, dww: Fix spelling for words used once, beginning with 'n' -> 'p', inclusive"

This reverts commit f1e19f22.

Issue #3219513 by smustgrave, quietone, sourabhjain, Vidushi Mehta, rpayanm, longwave, xjm, dww: Fix spelling for words used once, beginning with 'n' -> 'p', inclusive

Issue #3336780 by diegors, schlaukopf, xjm, fabiansierra5191: Correctly capitalize "url" in documentation only, part 2

Issue #3328454 by xjm, Bhanu951, jidrone, smustgrave: Replace most strpos() !== FALSE or === FALSE with str_contains()

Issue #3322743 by Spokje, mondrake: Fix PHPStan L2 errors "Parameter $foo of method Foo::bar() has invalid type Foo\Baz." and "Method Foo::bar() has invalid return type Foo\Baz. "

Issue #3035589 by slip, Berdir, wells, Neslee Canil Pinto, paulocs, indigoxela, alexpott, Wim Leers: Website exception via GET with QUERY_STRING "?_format=..."

Issue #3001430 by alexpott, _utsavsharma, Oscaner, lauriii, smustgrave, ifux, deviantintegral, pameeela: Unable to uninstall base theme and subtheme via config sync at the same time

Issue #3328443 by xjm, rpayanm, alexpott, catch, longwave: Replace most strpos() === 0 or !== 0 with str_starts_with()

Issue #2574981 by Manjit.Singh, dimaro, wengerk, darol100, izus, pguillard, vsujeetkumar, Himanshu5050, snehi, paulocs, rakesh.gectcr, jofitz, _utsavsharma, charginghawk, rajeshwari10, sdstyles, quietone, benjifisher, marcusvsouza, LoMo, joelpittet, justAChris, cilefen, YesCT, mradcliffe, spitzialist, annajl, jhodgdon, catch, alexpott, Sabbi0612, kattekrab, Mile23, antojose, leanderl, rodrigoac: Fix grammar ("an URL" should be "a URL") and consistent use of URL (not "url" / "Url") in documentation only