[Form][Validator] All index items after children are to be considered grand-children when resolving ViolationPath (fixes #11458)
[WebProfilerBundle] turbolinks compatibility
[Translation] made XliffFileDumper support CDATA sections.
[Form] FormBuilder::getIterator() now deals with resolved children
Fix potential DoS when parsing HOST
Test examples from Drupal SA-CORE-2014-003
fix parsing of Authorization header
fix handling of empty sequence items

When a line contains only a dash it cannot safely be assumed that
it contains a nested list or an embedded mapping. If the next line
starts with a dash at the same indentation, the current line's item
is to be treated as `null`.
[HttpFoundation] added some missing tests
[FrameworkBundle][Translator] Validate locales.
Add tests and more assertions
[DI] Added safeguards against invalid config in the YamlFileLoader

Exceptions explaining the mistake are better than fatal errors or weird
notices appearing when trying to deal with such invalid data.
Closes #11333
Forced all fragment uris to be signed, even for ESI
[WebProfiler] replaced the import/export feature from the web interface to a CLI tool
security #11828 n/a (nicolas-grekas, larowlan)

This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

1ee96a8 Test examples from Drupal SA-CORE-2014-003
5506ee8 Fix potential DoS when parsing HOST
security #11829 n/a (damz, fabpot)

This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

3b4046e [HttpFoundation] added some missing tests
cefe237 fix parsing of Authorization header
security #11830 n/a (aitboudad, Jérémy Derussé)

This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

9e1bc22 Add tests and more assertions
101a3b7 [FrameworkBundle][Translator] Validate locales.
security #11831 n/a (stof)

This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

654b1f2 Forced all fragment uris to be signed, even for ESI
security #11832 n/a (fabpot)

This PR was merged into the 2.3 branch.

Discussion
----------

n/a

n/a

Commits
-------

f38536a [WebProfiler] replaced the import/export feature from the web interface to a CLI tool
[HttpKernel] fixed internal fragment handling