Issue #2164025 by skipyT, pwolanin: Improve security of session ID against DB exposure or SQL injection.

Issue #2102477 by alexpott: Convert remainder of language negotiation settings to configuration system.

Issue #2169447 by damiankloip, sun, longwave: DX: Supply CacheBackendInterface::CACHE_PERMANENT as Cache::PERMANENT.

Issue #2152231 by rteijeiro, steveoliver, joelpittet, hussainweb, shanethehat, jenlampton, kpa, AnythonyR, EVIIILJ, kgoel, Cottser, dsdeiz, hanpersand: Convert theme_vertical_tabs() to Twig

Issue #2151101 by joelpittet, c4rl, IshaDakota, pplantinga, gnuget, longwave, jeanfei, sbudker1: Convert theme_status_report() to Twig

Oops. Wrong commit credit.

This reverts commit 6d5899ec.

Issue #2176131 by sun: Database configuration form in installer still uses 'db_prefix' instead of 'prefix'.

Issue #2177667 by InternetDevels | jessebeach: Replace theme() with drupal_render() in locale.bulk.inc.

Issue #2177673 by InternetDevels | jessebeach: Replace theme() with drupal_render() in Drupal/search_extra_type/Plugin/Search/SearchExtraTypeSearch.php.

Issue #2065917 by SpadXIII, andrewbelcher, kboopathi: SelectQueryExtender::hasAnyTag uses hasAnyTags which doesn't exist.

Issue #2172973 by tim.plunkett: Ensure ConfigEntities providing a list controller use admin_permission.

Issue #2028535 followup by tstoeckler: Provide a TourTestBase class for use by core and contrib modules.

Issue #2068329 by peximo, plach, LinL, marcingy, Désiré, penyaskito, herom, chx: Convert user SQL queries to the Entity Query API.

Issue #1868972 by jweowu: db_query_temporary() fails to create a table when the SQL has leading whitespace.

Issue #2167975 by amateescu, swentel: Entity_reference_create_instance does not support cardinality.

Issue #2103035 by batigolix, jhodgdon, clemens.tolboom: Review/update hook_help() for the basic_auth module.

Issue #2062039 by InternetDevels, Xano, h3rj4n: Replace user_access() calls with ->hasPermission() in user module.

Issue #2166399 by Wim Leers, nod_, clemens.tolboom: Changing CKEditor configurations by changing text formats causes markup to be lost: warn the user when performing this advanced action.

Issue #1636992 follow-up by nod_, droplet: Follow-up: form.js' formUpdated event is unreliable/incomplete.