Issue #3047699 by alfredofonseca, joachim, cosmicdreams: The class docs for the two password reset forms should differentiate them

Issue #3015752 by alexpott, bnjmnm: Properly deprecate USERNAME_MAX_LENGTH and USER_REGISTER_* constants

Issue #3019834 by Berdir, alexpott: Add @trigger_error() to deprecated url/link EntityInterface methods

Issue #2787871 by alexpott, yogeshmpawar, Insasse, Prashant.c, catch, hass: Properly deprecate getUserName() and use getAccountName() instead

Issue #2854252 by AdamPS, agoradesign, alexpott, Berdir, borisson_, xjm, jhedstrom, joachim: User forms broken for admin without 'administer users'

Issue #2935256 by Jo Fitzgerald, voleger, kim.pepper, ibustos, Yogesh Pawar, catch, jibran: Remove all usages of drupal_get_message and drupal_set_message in modules

Issue #2892821 by tedbow, zaporylie, alexpott, Wim Leers, dagmar, yoroy, effulgentsia, Bojhan: Core modules check node module's "access content" permission for displaying things that have nothing to do with nodes

Issue #2873696 by nvexler, wengerk, gido, Jo Fitzgerald, xjm: Add @internal to core classes, methods, properties to Form Classes

Issue #2901739 by andriyun, Jo Fitzgerald, mfernea, xjm: Fix 'Squiz.Arrays.ArrayDeclaration' coding standard

Issue #2722609 by anoopjohn, mfernea, Jo Fitzgerald, chishah92, druprad, martin107, Mile23: Fix Drupal.Commenting.FunctionComment.ParamNameNoMatch

Issue #2854529 by alexpott, xjm, klausi, Chi, Mixologic: Fix Drupal.Scope.MethodScope - all methods should have scopes

Issue #2776975 by joelpittet, dawehner, tim.plunkett, xjm, pfrenssen: March 3, 2017: Convert core to array syntax coding standards for Drupal 8.3.x RC phase

SA-CORE-2016-005 by larowlan, xjm, David_Rothstein, Dave Reid, Crell, cilefen, alexpott, mlhess, catch, pwolanin, YesCT, dawehner, quicksketch, Heine, znerol, charlotte.b, jnicola, ezraw

(cherry picked from commit c5da97f9)

Issue #2515050 by alexpott, pwolanin, YesCT, David_Rothstein, prasad_gogate: A valid one-time login link may be leaked by the referer header to 3rd parties

Issue #2624822 by chgasparoto, Lars Toomre, markdorison, anish.a, joshi.rohit100, Mile23, alexpott: Remove unused variables in user.module

Issue #2691025 by therealssj, ajalan065, Truptti, joyceg, yoroy, catch: Forgotten password message unnecessarily long

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

Drupal 8.0.4, SA-CORE-2016-001 by Alan Evans, benjy, berdir, catch, DamienMcKenna, Dave Reid, David_Rothstein, dsnopek, FengWen, fnqgpc, greggles, Gábor Hojtsy, klausi, larowlan, Pere Orga, plach, pwolanin, quicksketch, stefan.r, StryKaizer, YesCT

(cherry picked from commit f25feddd)

Conflicts:
	core/lib/Drupal.php

Issue #2576037 by unqunq, er.manojsharma, sdstyles, martins.kajins, Devaraj johnson, cilefen, Bojhan, Wim Leers: "Sorry" in user-facing errors violates the User Interface Standards

Issue #2563751 by borisson_, rocketeerbkw, cilefen, NikitaJain, imanol.eguskiza, pjonckiere: Password field errors on user create/edit/login when password is (literally) 0

Issue #2551453 by LoMo, Ayesh, jaxxed, LinL, madhavvyas, Miraya: Follow-up: Consistently use "email" instead of "e-mail" in Drupal

Issue #2570355 by Sutharsan, stefan.r, kgoel, josephdpurcell, joelpittet, justAChris, dawehner, pfrenssen, pwolanin, David_Rothstein, catch: Replace remaining !placeholder and @placeholder with :placeholder for URLs

Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk, olli: Remove all usages SafeMarkup::checkPlain() from render arrays

Revert "Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk: Remove all usages SafeMarkup::checkPlain() from render arrays"

This reverts commit 31007609.

Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk: Remove all usages SafeMarkup::checkPlain() from render arrays

Issue #2484037 by plach, Gábor Hojtsy, YesCT, dawehner: Make Views bulk operations entity translation aware

Issue #753898 by corbacho, weri, opdavies, dscl, idebr, willzyx, manauwarsheikh, dansologuren, yoroy, alexpott: Wrong message for blocked users who request password reset

Issue #2488610 by catch, kim.pepper, Berdir: Use ModuleHander::getName() instead of rebuilding module data on permissions page

Issue #2487808 by JesseSturgis, Scott Weston: autocorrect="off" and autocapitalize="off" in login form are deprecated and may be not enough

Issue #2463009 by Wim Leers: Introduce CacheableResponseInterface: consolidate ways of setting X-Drupal-Cache-Tags/Contexts headers

Issue #2444231 by Wim Leers, nlisgo: Fix CacheableInterface so it makes sense (was: "Make Config objects & Entities implement CacheableInterface + add BubbleableMetadata::createFromCacheableObject()")