update

web/core/lib/Drupal/Component/Annotation/Plugin.php

@@ -39,7 +39,7 @@ class Plugin implements AnnotationInterface {
       return $value !== NULL;
     });
     $parsed_values = $this->parse($values);
-    $this->definition = NestedArray::mergeDeep($defaults, $parsed_values);
+    $this->definition = NestedArray::mergeDeepArray([$defaults, $parsed_values], TRUE);
   }
 
   /**

web/core/lib/Drupal/Component/FileSecurity/FileSecurity.php

@@ -26,7 +26,7 @@ class FileSecurity {
    *   TRUE if the file already exists or was created. FALSE otherwise.
    */
   public static function writeHtaccess($directory, $deny_public_access = TRUE, $force = FALSE) {
-    return self::writeFile($directory, '/.htaccess', self::htaccessLines($deny_public_access), $force);
+    return self::writeFile($directory, '.htaccess', self::htaccessLines($deny_public_access), $force);
   }
 
   /**
@@ -110,7 +110,7 @@ EOF;
    *   TRUE if the file already exists or was created. FALSE otherwise.
    */
   public static function writeWebConfig($directory, $force = FALSE) {
-    return self::writeFile($directory, '/web.config', self::webConfigLines(), $force);
+    return self::writeFile($directory, 'web.config', self::webConfigLines(), $force);
   }
 
   /**
@@ -152,7 +152,12 @@ EOT;
     if (file_exists($file_path) && !$force) {
       return TRUE;
     }
-    if (file_exists($directory) && is_writable($directory) && file_put_contents($file_path, $contents)) {
+    // Writing the file can fail if:
+    // - concurrent requests are both trying to write at the same time.
+    // - $directory does not exist or is not writable.
+    // Testing for these conditions introduces windows for concurrency issues to
+    // occur.
+    if (@file_put_contents($file_path, $contents)) {
       return @chmod($file_path, 0444);
     }
     return FALSE;

web/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php

@@ -222,6 +222,7 @@ class MTimeProtectedFastFileStorage extends FileStorage {
    *   The directory where the temporary filename will be created.
    * @param $prefix
    *   The prefix of the generated temporary filename.
+   *
    * @return string
    *   Returns the new temporary filename (with path), or FALSE on failure.
    */

web/core/lib/Drupal/Component/PhpStorage/PhpStorageInterface.php

@@ -52,7 +52,7 @@ interface PhpStorageInterface {
   public function save($name, $code);
 
   /**
-   * Whether this is a writeable storage.
+   * Whether this is a writable storage.
    *
    * @return bool
    */

web/core/lib/Drupal/Component/Plugin/Derivative/DeriverInterface.php

@@ -32,6 +32,7 @@ interface DeriverInterface {
    *
    * @param array $base_plugin_definition
    *   The definition array of the base plugin.
+   *
    * @return array
    *   An array of full derivative definitions keyed on derivative id.
    *

web/core/lib/Drupal/Component/Utility/Random.php

@@ -249,6 +249,7 @@ class Random {
    * Generate paragraphs separated by double new line.
    *
    * @param int $paragraph_count
+   *
    * @return string
    */
   public function paragraphs($paragraph_count = 12) {

web/core/lib/Drupal/Component/Utility/Xss.php

@@ -70,7 +70,7 @@ class Xss {
 
     // Defuse all HTML entities.
     $string = str_replace('&', '&', $string);
-    // Change back only well-formed entities in our whitelist:
+    // Change back only well-formed entities in our list of allowed html tags:
     // Decimal numeric entities.
     $string = preg_replace('/&#([0-9]+;)/', '&#\1', $string);
     // Hexadecimal numeric entities.
@@ -83,7 +83,7 @@ class Xss {
     $splitter = function ($matches) use ($html_tags, $class) {
       return $class::split($matches[1], $html_tags, $class);
     };
-    // Strip any tags that are not in the whitelist.
+    // Strip any tags that are not in the list of allowed html tags.
     return preg_replace_callback('%
       (
       <(?=[^a-zA-Z!/])  # a lone <
@@ -161,7 +161,9 @@ class Xss {
       $elem = '!--';
     }
 
-    // When in whitelist mode, an element is disallowed when not listed.
+    // Defer to the ::needsRemoval() method to decide if the element is to be
+    // removed. This allows the list of tags to be treated as either a list of
+    // allowed tags or a list of denied tags.
     if ($class::needsRemoval($html_tags, $elem)) {
       return '';
     }