Issue #3358514 by poker10, mcdruid, smustgrave: Make phpinfo on the admin status report configurable

SA-CORE-2023-005 by benjifisher, Heine, cmlara, mlhess, larowlan, David_Rothstein, xjm, Wim Leers, DamienMcKenna, effulgentsia, pwolanin, mcdruid, poker10, jenlampton, longwave, kim.pepper, alexpott, drumm

Issue #3027639 by catch, jonhattan, ankithashetty, Lal_, voleger, beunerd, cmlara, yogeshmpawar, Jose Reyero, drfuzetto, MiguelArber, smustgrave, longwave, Berdir, leandro713, Ambient.Impact, olli, amitaibu: Make css/js optimized assets path configurable

Issue #3336463 by sleitner, recrit, catch: Htaccess rewrite rules for gzipped CSS and JavaScript aggregates never match

Issue #3311406 by Anybody, Grevil, nod_: .htaccess ExpiresDefault (2W) is much too low. Should be ~1Y

Issue #3328454 by xjm, Bhanu951, jidrone, smustgrave: Replace most strpos() !== FALSE or === FALSE with str_contains()

Issue #3107548 by tunic, roderik, nicrodgers, greggles, anita_novicell, larowlan: Enhance hash_salt documentation in default.settings.php

Issue #3150614 by pfrenssen, cilefen, murilohp, FinnishFlash, mpp, andypost, ranjith_kumar_k_u, vagelis-prokopiou, rpayanm, tsplash, blazey, Winn, znerol, alexpott, Berdir, mxr576, catch, anagomes: Set SameSite on session cookies

Revert "Issue #3150614 by pfrenssen, cilefen, murilohp, FinnishFlash, mpp, andypost, ranjith_kumar_k_u, vagelis-prokopiou, blazey, tsplash, Winn, alexpott, Berdir, mxr576: Set SameSite on session cookies"

This reverts commit a3bddae4.

Issue #3150614 by pfrenssen, cilefen, murilohp, FinnishFlash, mpp, andypost, ranjith_kumar_k_u, vagelis-prokopiou, blazey, tsplash, Winn, alexpott, Berdir, mxr576: Set SameSite on session cookies

Issue #3317265 by ressa, smustgrave: Use immediately visible and functioning String override example

Issue #3333281 by MustangGB, smustgrave, xjm: Give trusted host configuration hint in default.settings.php

Issue #2854817 by Liam Morland, longwave, alexpott, JoshaHubbers, effulgentsia, alex-b, Mile23, thalles, mr.baileys, Wim Leers, xjm: Duplicate X-Content-Type-Options headers both with the value nosniff

Issue #3191389 by anmolgoyal74, greggles, larowlan, mcdruid, pwolanin, brayfe: File Inclusion issue security hardening

Issue #3327115 by Eric_A, alexpott, xjm, longwave, pandaski: .htaccess rules broken since yarn.lock got added

Issue #3260401 by idebr, Spokje, Akram Khan, mcdruid, longwave, alexpott: Google is abandoning FLoC - so remove the header

Issue #3112452 by lalitware, guilhermevp, narendra.rajwar27, WagnerMelo, ravi.shankar, mradcliffe, adalbertov, himanshu_sindhwani, quondam, Vidushi Mehta, alexpott, longwave, anmolgoyal74: Fix indentation consistency in core's yaml files

Issue #3271222 by Rajab Natshah, yogeshmpawar, BramDriesen: Include Disallow Oembed media links in the robots.txt file for better Drupal SEO

Issue #3305748 by kay_v, Spokje, bmahesh03121: improve instructions for allowedOrigins in default.services.yml

Issue #3096101 by quietone, danflanagan8, abhisekmazumdar, anmolgoyal74, alexpott, gabesullice, Wim Leers, Matroskeen, ankithashetty, mikelutz, benjifisher, daffie, webchick: Allow migrate_drupal_ui source database to be set in settings.php

Issue #1040534 by catch, Owen Barton, danreb, mikeytown2, ogi, omega8cc, xjm: Rewrite rules for gzipped CSS and JavaScript aggregates cause lots of lstats for files that will never exist

SA-CORE-2022-016 by fabpot, nicolas.grekas, xjm, lauriii, alexpott, Berdir, larowlan, catch, longwave, cilefen, james.williams, benjifisher

Issue #3079404 by anavarre: Document that .htaccess 301s get the ExpiresDefault value of 2 weeks instead of the Drupal value

Issue #2381797 by Tom Verhaeghe, slashrsm, johnwebdev, chr.fritsch, ankithashetty, Krzysztof Domański, nevergone, tobiasb, yogeshmpawar, anmolgoyal74, dhirendra.mishra, Wim Leers, longwave, Fabianx, andypost, joachim, alexpott: Add render_cache debug output

Issue #3262674 by tstoeckler, lauriii, cindytwilliams, mherchel, Gábor Hojtsy: Use Claro instead of Bartik as fallback maintenance theme

Issue #3119840 by raman.b, hugovk, johnwebdev, dawehner: Support syntax highlighting on GitHub for non-standard PHP extension files

SA-CORE-2022-012 by cmlara, GuyPaddock, larowlan, mondrake, effulgentsia, xjm, longwave, Dave Reid, lauriii, David Strauss, benjifisher, alexpott, mcdruid, Fabianx

(cherry picked from commit 1f82337d)

Issue #3292908 by alexpott, dww, longwave, catch, Berdir, Charlie ChX Negyesi, mradcliffe, kndr: Fast 404s are slower than regular 404s

Issue #3295650 by Spokje, BR0kEN, Berdir, catch, Krzysztof Domański, longwave, voleger, neclimdul: Stop recommending using \Drupal\Component\Assertion\Handle::register() in example.settings.local.php

Issue #2733675 by smccabe, murilohp, andregp, Johnny Santos, ankithashetty, mglaman, jonathanshaw, daffie, alexpott, catch, froboy: Warning when mysql is not set to READ-COMMITTED

Issue #3166449 by ravi.shankar, adamzimmermann, mmatsoo, walangitan, joshua.boltz, Cottser: Improve wording around twig.cache setting for production environments

Issue #3175428 by tunic, kishor_kolekar, ranjith_kumar_k_u: Add link to "Trusted host settings" in default.settings.php

Issue #3129043 by mondrake, daffie, ankithashetty, ravi.shankar, alexpott, Beakerboy, catch: Move core database drivers to modules of their own