Issue #2304949 by mpdonadio, cilefen, znerol, klausi, gaurav.goyal, regilero: Port HTTP Host header DoS fix from SA-CORE-2014-003
Issue #2378699 by klausi, David_Rothstein, pwolanin: Port session hijacking fixes from SA-CORE-2014-006 to Drupal 8
Issue #2346937 by dawehner, larowlan, Wim Leers, claudiu.cristea, msonnabaum: Implement a Renderer service; reduces drupal_render / _theme service container calls
Issue #2378263 by Wim Leers: hook_library_alter() must be manually invoked by users of LibraryDiscovery, and has no test coverage
Issue #2379083 by olli, Wim Leers: Regression (again): Menu contextual links no longer visible in menu blocks, when block caching is enabled
Issue #1855066 by Tom Verhaeghe, Wim Leers, benjifisher: In the "menu" toolbar tray, clicking/tapping white space should show the child level
Issue #2377449 by sqndr: Seven maintenance page theming incorrect
Issue #2378583 by tim.plunkett, EclipseGc: Core ContextAware Plugins have inconsistent ContextDefinition return docs
Issue #2371853 by tim.plunkett, larowlan: Add more helper methods around temporary FAPI storage
Issue #2376689 by yched: IntegerItem 'size' setting should be a storage setting