update

composer.json

@@ -18,8 +18,10 @@
         "composer/installers": "^1.2",
         "drupal/address": "^1.8",
         "drupal/audiofield": "^1.9",
+        "drupal/backup_migrate": "^4.1",
         "drupal/core-composer-scaffold": "^8.8",
         "drupal/core-recommended": "^8.8",
+        "drupal/entity_browser_enhanced": "^1.0",
         "drupal/field_group": "^3.0",
         "drupal/field_token_value": "^1.0",
         "drupal/linkit": "^4.3",
@@ -28,8 +30,11 @@
         "drupal/paragraphs": "^1.12",
         "drupal/pathauto": "^1.8",
         "drupal/schema_metatag": "^1.5",
+        "drupal/site_settings": "^1.19",
         "drupal/subpathauto": "^1.1",
         "drupal/time_range": "^8.1",
+        "drupal/transliterate_filenames": "^1.4",
+        "drupal/varbase_total_control": "^6.11",
         "drupal/video_embed_field": "^2.4",
         "drupal/views_url_path_arguments": "^1.1",
         "drush/drush": "^10.2",

web/core/CHANGELOG.txt

@@ -3,6 +3,6 @@ patch (bugfix) releases are released every month. More information on the
 Drupal release cycle: https://www.drupal.org/core/release-cycle-overview
 
 * For a full list of fixes in the latest release, visit:
- https://www.drupal.org/8/download
+ https://www.drupal.org/latest-release
 * API change records for Drupal core:
  https://www.drupal.org/list-changes/drupal

web/core/INSTALL.sqlite.txt

@@ -20,13 +20,13 @@ SQLITE DATABASE CREATION
 The Drupal installer will create the SQLite database for you. The only
 requirement is that the installer must have write permissions to the directory
 where the database file resides. This directory (not just the database file) also
-has to remain writeable by the web server going forward for SQLite to continue to
+has to remain writable by the web server going forward for SQLite to continue to
 be able to operate.
 
 On the "Database configuration" form in the "Database file" field, you must
 supply the exact path to where you wish your database file to reside. It is
 strongly suggested that you choose a path that is outside of the webroot, yet
-ensure that the directory is writeable by the web server.
+ensure that the directory is writable by the web server.
 
 If you must place your database file in your webroot, you could try using the
 following in your "Database file" field:

web/core/INSTALL.txt

@@ -190,7 +190,7 @@ INSTALLATION
         chmod a+w sites/default/files
 
       Be sure to set the permissions for the default directory back after the
-      installation is finished! (Leave the files directory writeable.)
+      installation is finished! (Leave the files directory writable.)
       Sample command:
 
         chmod go-w sites/default

web/core/includes/bootstrap.inc

@@ -681,11 +681,17 @@ function drupal_valid_test_ua($new_prefix = NULL) {
     // Ensure that no information leaks on production sites.
     $test_db = new TestDatabase($prefix);
     $key_file = DRUPAL_ROOT . '/' . $test_db->getTestSitePath() . '/.htkey';
-    if (!is_readable($key_file)) {
+    if (!is_readable($key_file) || is_dir($key_file)) {
       header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
       exit;
     }
     $private_key = file_get_contents($key_file);
+    // The string from drupal_generate_test_ua() is 74 bytes long. If we don't
+    // have it, tests cannot be allowed.
+    if (empty($private_key) || strlen($private_key) < 74) {
+      header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+      exit;
+    }
     // The file properties add more entropy not easily accessible to others.
     $key = $private_key . filectime(__FILE__) . fileinode(__FILE__);
     $time_diff = REQUEST_TIME - $time;

web/core/includes/file.inc

@@ -683,7 +683,7 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) {
     // http://php.net/manual/security.filesystem.nullbytes.php
     $filename = str_replace(chr(0), '', $filename);
 
-    $whitelist = array_unique(explode(' ', strtolower(trim($extensions))));
+    $allowed_extensions = array_unique(explode(' ', strtolower(trim($extensions))));
 
     // Split the filename up by periods. The first part becomes the basename
     // the last part the final extension.
@@ -698,7 +698,7 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) {
     // of allowed extensions.
     foreach ($filename_parts as $filename_part) {
       $new_filename .= '.' . $filename_part;
-      if (!in_array(strtolower($filename_part), $whitelist) && preg_match("/^[a-zA-Z]{2,5}\d?$/", $filename_part)) {
+      if (!in_array(strtolower($filename_part), $allowed_extensions) && preg_match("/^[a-zA-Z]{2,5}\d?$/", $filename_part)) {
         $new_filename .= '_';
       }
     }

web/core/includes/install.core.inc

@@ -1023,7 +1023,7 @@ function install_display_output($output, $install_state) {
   // Prevent install.php from being indexed when installed in a sub folder.
   // robots.txt rules are not read if the site is within domain.com/subfolder
   // resulting in /subfolder/install.php being found through search engines.
-  // When settings.php is writeable this can be used via an external database
+  // When settings.php is writable this can be used via an external database
   // leading a malicious user to gain php access to the server.
   $noindex_meta_tag = [
     '#tag' => 'meta',

web/core/includes/install.inc

@@ -478,6 +478,7 @@ function _drupal_rewrite_settings_global(&$ref, $variable) {
  *   The container for variable values.
  * @param string $variable_name
  *   Name of variable.
+ *
  * @return string
  *   A string containing valid PHP code of the variable suitable for placing
  *   into settings.php.
@@ -508,6 +509,7 @@ function _drupal_rewrite_settings_dump($variable, $variable_name) {
  *   A string to prepend to the variable's value.
  * @param string $suffix
  *   A string to append to the variable's value.
+ *
  * @return string
  *   A string containing valid PHP code of the variable suitable for placing
  *   into settings.php.

web/core/lib/Drupal.php

@@ -82,7 +82,7 @@ class Drupal {
   /**
    * The current system version.
    */
-  const VERSION = '8.9.0';
+  const VERSION = '8.9.2';
 
   /**
    * Core API compatibility.

web/core/lib/Drupal/Component/Annotation/Plugin.php

@@ -39,7 +39,7 @@ class Plugin implements AnnotationInterface {
       return $value !== NULL;
     });
     $parsed_values = $this->parse($values);
-    $this->definition = NestedArray::mergeDeep($defaults, $parsed_values);
+    $this->definition = NestedArray::mergeDeepArray([$defaults, $parsed_values], TRUE);
   }
 
   /**

web/core/lib/Drupal/Component/FileSecurity/FileSecurity.php

@@ -26,7 +26,7 @@ class FileSecurity {
    *   TRUE if the file already exists or was created. FALSE otherwise.
    */
   public static function writeHtaccess($directory, $deny_public_access = TRUE, $force = FALSE) {
-    return self::writeFile($directory, '/.htaccess', self::htaccessLines($deny_public_access), $force);
+    return self::writeFile($directory, '.htaccess', self::htaccessLines($deny_public_access), $force);
   }
 
   /**
@@ -110,7 +110,7 @@ EOF;
    *   TRUE if the file already exists or was created. FALSE otherwise.
    */
   public static function writeWebConfig($directory, $force = FALSE) {
-    return self::writeFile($directory, '/web.config', self::webConfigLines(), $force);
+    return self::writeFile($directory, 'web.config', self::webConfigLines(), $force);
   }
 
   /**
@@ -152,7 +152,12 @@ EOT;
     if (file_exists($file_path) && !$force) {
       return TRUE;
     }
-    if (file_exists($directory) && is_writable($directory) && file_put_contents($file_path, $contents)) {
+    // Writing the file can fail if:
+    // - concurrent requests are both trying to write at the same time.
+    // - $directory does not exist or is not writable.
+    // Testing for these conditions introduces windows for concurrency issues to
+    // occur.
+    if (@file_put_contents($file_path, $contents)) {
       return @chmod($file_path, 0444);
     }
     return FALSE;

web/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php

@@ -222,6 +222,7 @@ class MTimeProtectedFastFileStorage extends FileStorage {
    *   The directory where the temporary filename will be created.
    * @param $prefix
    *   The prefix of the generated temporary filename.
+   *
    * @return string
    *   Returns the new temporary filename (with path), or FALSE on failure.
    */

web/core/lib/Drupal/Component/PhpStorage/PhpStorageInterface.php

@@ -52,7 +52,7 @@ interface PhpStorageInterface {
   public function save($name, $code);
 
   /**
-   * Whether this is a writeable storage.
+   * Whether this is a writable storage.
    *
    * @return bool
    */

web/core/lib/Drupal/Component/Plugin/Derivative/DeriverInterface.php

@@ -32,6 +32,7 @@ interface DeriverInterface {
    *
    * @param array $base_plugin_definition
    *   The definition array of the base plugin.
+   *
    * @return array
    *   An array of full derivative definitions keyed on derivative id.
    *

web/core/lib/Drupal/Component/Utility/Random.php

@@ -249,6 +249,7 @@ class Random {
    * Generate paragraphs separated by double new line.
    *
    * @param int $paragraph_count
+   *
    * @return string
    */
   public function paragraphs($paragraph_count = 12) {

web/core/lib/Drupal/Component/Utility/Xss.php

@@ -70,7 +70,7 @@ class Xss {
 
     // Defuse all HTML entities.
     $string = str_replace('&', '&', $string);
-    // Change back only well-formed entities in our whitelist:
+    // Change back only well-formed entities in our list of allowed html tags:
     // Decimal numeric entities.
     $string = preg_replace('/&#([0-9]+;)/', '&#\1', $string);
     // Hexadecimal numeric entities.
@@ -83,7 +83,7 @@ class Xss {
     $splitter = function ($matches) use ($html_tags, $class) {
       return $class::split($matches[1], $html_tags, $class);
     };
-    // Strip any tags that are not in the whitelist.
+    // Strip any tags that are not in the list of allowed html tags.
     return preg_replace_callback('%
       (
       <(?=[^a-zA-Z!/])  # a lone <
@@ -161,7 +161,9 @@ class Xss {
       $elem = '!--';
     }
 
-    // When in whitelist mode, an element is disallowed when not listed.
+    // Defer to the ::needsRemoval() method to decide if the element is to be
+    // removed. This allows the list of tags to be treated as either a list of
+    // allowed tags or a list of denied tags.
     if ($class::needsRemoval($html_tags, $elem)) {
       return '';
     }

web/core/lib/Drupal/Core/Asset/AssetResolver.php

@@ -188,6 +188,7 @@ class AssetResolver implements AssetResolverInterface {
    *
    * @param \Drupal\Core\Asset\AttachedAssetsInterface $assets
    *   The assets attached to the current response.
+   *
    * @return array
    *   A (possibly optimized) collection of JavaScript assets.
    */

web/core/lib/Drupal/Core/Batch/BatchBuilder.php

@@ -205,12 +205,18 @@ class BatchBuilder {
    * The path should be relative to base_path(), and thus should be built using
    * drupal_get_path(). Defaults to {module_name}.module.
    *
+   * The file needs to be set before using ::addOperation(),
+   * ::setFinishCallback(), or any other function that uses callbacks from the
+   * file. This is so that PHP knows about the included functions.
+   *
    * @param string $filename
    *   The path to the file.
    *
    * @return $this
    */
   public function setFile($filename) {
+    include_once $filename;
+
     $this->file = $filename;
     return $this;
   }

web/core/lib/Drupal/Core/Command/DbCommandBase.php

@@ -26,6 +26,7 @@ class DbCommandBase extends Command {
    *
    * @param \Symfony\Component\Console\Input\InputInterface $input
    *   Input object.
+   *
    * @return \Drupal\Core\Database\Connection
    */
   protected function getDatabaseConnection(InputInterface $input) {

web/core/lib/Drupal/Core/Command/DbDumpCommand.php

@@ -70,6 +70,7 @@ class DbDumpCommand extends DbCommandBase {
    *   The database connection to use.
    * @param array $schema_only
    *   Table patterns for which to only dump the schema, no data.
+   *
    * @return string
    *   The PHP script.
    */
@@ -105,6 +106,7 @@ class DbDumpCommand extends DbCommandBase {
    *
    * @param \Drupal\Core\Database\Connection $connection
    *   The database connection to use.
+   *
    * @return array
    *   An array of table names.
    */

web/core/lib/Drupal/Core/Config/TypedConfigManager.php

@@ -269,6 +269,7 @@ class TypedConfigManager extends TypedDataManager implements TypedConfigManagerI
    *   Configuration name with variables in square brackets.
    * @param mixed $data
    *   Configuration data for the element.
+   *
    * @return string
    *   Configuration name with variables replaced.
    */

web/core/lib/Drupal/Core/Database/Connection.php

@@ -778,6 +778,7 @@ abstract class Connection {
    *
    * @param string $class
    *   The class for which we want the potentially driver-specific class.
+   *
    * @return string
    *   The name of the class that should be used for this driver.
    */

web/core/lib/Drupal/Core/Database/Driver/mysql/Schema.php

@@ -87,6 +87,7 @@ class Schema extends DatabaseSchema {
    *   The name of the table to create.
    * @param $table
    *   A Schema API table definition array.
+   *
    * @return
    *   An array of SQL statements to create the table.
    */

web/core/lib/Drupal/Core/Database/Driver/pgsql/Connection.php

@@ -281,6 +281,7 @@ class Connection extends DatabaseConnection {
    *
    * @param $string
    *   The string to escape.
+   *
    * @return string
    *   The escaped string.
    */

web/core/lib/Drupal/Core/Database/Driver/pgsql/Schema.php

@@ -99,6 +99,7 @@ class Schema extends DatabaseSchema {
    *
    * @param $table_name
    *   The non-prefixed name of the table.
+   *
    * @return
    *   An object with two member variables:
    *     - 'blob_fields' that lists all the blob fields in the table.
@@ -264,6 +265,7 @@ EOD;
    *   The name of the table to create.
    * @param $table
    *   A Schema API table definition array.
+   *
    * @return
    *   An array of SQL statements to create the table.
    */
@@ -1074,6 +1076,7 @@ EOD;
    *
    * @param $data
    *   String to be hashed.
+   *
    * @return string
    *   A base-64 encoded sha-256 hash, with + and / replaced with _ and any =
    *   padding characters removed.

web/core/lib/Drupal/Core/Database/Driver/sqlite/Schema.php

@@ -48,6 +48,7 @@ class Schema extends DatabaseSchema {
    *   The name of the table to create.
    * @param $table
    *   A Schema API table definition array.
+   *
    * @return
    *   An array of SQL statements to create the table.
    */

web/core/lib/Drupal/Core/Database/Log.php

@@ -69,6 +69,7 @@ class Log {
    *
    * @param $logging_key
    *   The logging key to fetch.
+   *
    * @return
    *   An indexed array of all query records for this logging key.
    */

web/core/lib/Drupal/Core/Database/Query/SelectInterface.php

@@ -169,6 +169,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *
    * @param $distinct
    *   TRUE to flag this query DISTINCT, FALSE to disable it.
+   *
    * @return $this
    *   The called object.
    */
@@ -188,6 +189,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   automatically based on the $table_alias and $field. The alias will be
    *   checked for uniqueness, so the requested alias may not be the alias
    *   that is assigned in all cases.
+   *
    * @return
    *   The unique alias that was assigned for this field.
    */
@@ -211,6 +213,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   An indexed array of fields present in the specified table that should be
    *   included in this query. If not specified, $table_alias.* will be generated
    *   without any aliases.
+   *
    * @return $this
    *   The called object.
    */
@@ -232,6 +235,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   in all cases.
    * @param $arguments
    *   Any placeholder arguments needed for this expression.
+   *
    * @return
    *   The unique alias that was assigned for this expression.
    */
@@ -260,6 +264,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   system, for example, when joining the same table more than once.
    * @param $arguments
    *   An array of arguments to replace into the $condition of this join.
+   *
    * @return
    *   The unique alias that was assigned for this table.
    */
@@ -286,6 +291,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   system, for example, when joining the same table more than once.
    * @param $arguments
    *   An array of arguments to replace into the $condition of this join.
+   *
    * @return
    *   The unique alias that was assigned for this table.
    */
@@ -312,6 +318,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   system, for example, when joining the same table more than once.
    * @param $arguments
    *   An array of arguments to replace into the $condition of this join.
+   *
    * @return
    *   The unique alias that was assigned for this table.
    */
@@ -338,6 +345,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   system, for example, when joining the same table more than once.
    * @param $arguments
    *   An array of arguments to replace into the $condition of this join.
+   *
    * @return
    *   The unique alias that was assigned for this table.
    *
@@ -379,6 +387,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   system, for example, when joining the same table more than once.
    * @param $arguments
    *   An array of arguments to replace into the $condition of this join.
+   *
    * @return
    *   The unique alias that was assigned for this table.
    */
@@ -411,6 +420,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    * @param $direction
    *   The direction to sort. Legal values are "ASC" and "DESC". Any other value
    *   will be converted to "ASC".
+   *
    * @return $this
    *   The called object.
    */
@@ -449,6 +459,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   range directives that are set.
    * @param $length
    *   The number of records to return from the result set.
+   *
    * @return $this
    *   The called object.
    */
@@ -474,6 +485,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    * @param $type
    *   The type of UNION to add to the query. Defaults to plain
    *   UNION.
+   *
    * @return $this
    *   The called object.
    */
@@ -484,6 +496,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *
    * @param $field
    *   The field on which to group. This should be the field as aliased.
+   *
    * @return $this
    *   The called object.
    */
@@ -539,6 +552,7 @@ interface SelectInterface extends ConditionInterface, AlterableInterface, Extend
    *   The comparison operator, such as =, <, or >=. It also accepts more complex
    *   options such as IN, LIKE, or BETWEEN. Defaults to IN if $value is an array
    *   = otherwise.
+   *
    * @return \Drupal\Core\Database\Query\ConditionInterface
    *   The called object.
    */

web/core/lib/Drupal/Core/Database/StatementPrefetch.php

@@ -216,6 +216,7 @@ class StatementPrefetch implements \Iterator, StatementInterface {
    *   The query.
    * @param array|null $args
    *   An array of arguments. This can be NULL.
+   *
    * @return \PDOStatement
    *   A PDOStatement object.
    */

web/core/lib/Drupal/Core/Entity/EntityDisplayBase.php

@@ -452,6 +452,7 @@ abstract class EntityDisplayBase extends ConfigEntityBase implements EntityDispl
    *
    * @param \Drupal\Core\Field\FieldDefinitionInterface $definition
    *   A field definition.
+   *
    * @return array|null
    */
   private function fieldHasDisplayOptions(FieldDefinitionInterface $definition) {

web/core/lib/Drupal/Core/Entity/Query/ConditionAggregateInterface.php

@@ -35,6 +35,7 @@ interface ConditionAggregateInterface extends \Countable {
    *
    * @param $field
    * @param string $langcode
+   *
    * @return ConditionInterface
    * @see \Drupal\Core\Entity\Query\QueryInterface::exists()
    */
@@ -44,6 +45,7 @@ interface ConditionAggregateInterface extends \Countable {
    * Queries for the nonexistence of a field.
    *
    * @param string $field
+   *
    * @return ConditionInterface
    * @see \Drupal\Core\Entity\Query\QueryInterface::notExists()
    */

web/core/lib/Drupal/Core/Entity/Query/QueryInterface.php

@@ -107,6 +107,7 @@ interface QueryInterface extends AlterableInterface {
    *   Name of a field.
    * @param $langcode
    *   Language code (optional).
+   *
    * @return $this
    */
   public function exists($field, $langcode = NULL);
@@ -118,6 +119,7 @@ interface QueryInterface extends AlterableInterface {
    *   Name of a field.
    * @param $langcode
    *   Language code (optional).
+   *
    * @return $this
    */
   public function notExists($field, $langcode = NULL);

web/core/lib/Drupal/Core/Entity/Query/Sql/QueryAggregate.php

@@ -144,6 +144,7 @@ class QueryAggregate extends Query implements QueryAggregateInterface {
    *   The field as passed in by the caller.
    * @param string $sql_field
    *   The sql field as returned by getSqlField.
+   *
    * @return string
    *   The SQL alias expected in the return value. The dots in $sql_field are
    *   replaced with underscores and if a default fallback to .value happened,

web/core/lib/Drupal/Core/Entity/Query/Sql/Tables.php

@@ -373,7 +373,9 @@ class Tables implements TablesInterface {
    *
    * @param $field_name
    *   Name of the field.
+   *
    * @return string
+   *
    * @throws \Drupal\Core\Entity\Query\QueryException
    */
   protected function ensureFieldTable($index_prefix, &$field, $type, $langcode, $base_table, $entity_id_field, $field_id_field, $delta) {

web/core/lib/Drupal/Core/Extension/ModuleInstaller.php

@@ -193,14 +193,9 @@ class ModuleInstaller implements ModuleInstallerInterface {
           }
         }
 
-        // Update the module handler in order to load the module's code.
-        // This allows the module to participate in hooks and its existence to
-        // be discovered by other modules.
-        // The current ModuleHandler instance is obsolete with the kernel
-        // rebuild below.
+        // Update the module handler in order to have the correct module list
+        // for the kernel update.
         $this->moduleHandler->setModuleList($module_filenames);
-        $this->moduleHandler->load($module);
-        module_load_install($module);
 
         // Clear the static cache of the "extension.list.module" service to pick
         // up the new module, since it merges the installation status of modules
@@ -210,6 +205,10 @@ class ModuleInstaller implements ModuleInstallerInterface {
         // Update the kernel to include it.
         $this->updateKernel($module_filenames);
 
+        // Load the module's .module and .install files.
+        $this->moduleHandler->load($module);
+        module_load_install($module);
+
         // Replace the route provider service with a version that will rebuild
         // if routes used during installation. This ensures that a module's
         // routes are available during installation. This has to occur before

web/core/lib/Drupal/Core/Field/FieldConfigBase.php

@@ -125,9 +125,10 @@ abstract class FieldConfigBase extends ConfigEntityBase implements FieldConfigIn
    *
    * The default value is expressed as a numerically indexed array of items,
    * each item being an array of key/value pairs matching the set of 'columns'
-   * defined by the "field schema" for the field type, as exposed in
-   * hook_field_schema(). If the number of items exceeds the cardinality of the
-   * field, extraneous items will be ignored.
+   * defined by the "field schema" for the field type, as exposed in the class
+   * implementing \Drupal\Core\Field\FieldItemInterface::schema() method. If the
+   * number of items exceeds the cardinality of the field, extraneous items will
+   * be ignored.
    *
    * This property is overlooked if the $default_value_callback is non-empty.
    *

web/core/lib/Drupal/Core/File/file.api.php

@@ -22,6 +22,7 @@ use Drupal\Core\StreamWrapper\StreamWrapperManager;
  *
  * @param $uri
  *   The URI of the file.
+ *
  * @return
  *   If the user does not have permission to access the file, return -1. If the
  *   user has permission, return an array with the appropriate headers. If the

web/core/lib/Drupal/Core/Form/FormBuilder.php

@@ -19,6 +19,7 @@ use Drupal\Core\Security\TrustedCallbackInterface;
 use Drupal\Core\Theme\ThemeManagerInterface;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 use Symfony\Component\HttpFoundation\FileBag;
+use Symfony\Component\HttpFoundation\ParameterBag;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -957,8 +958,16 @@ class FormBuilder implements FormBuilderInterface, FormValidatorInterface, FormS
             // This value is checked in self::handleInputElement().
             $form_state->setInvalidToken(TRUE);
 
+            // Ignore all submitted values.
+            $form_state->setUserInput([]);
+
+            $request = $this->requestStack->getCurrentRequest();
+            // Do not trust any POST data.
+            $request->request = new ParameterBag();
             // Make sure file uploads do not get processed.
-            $this->requestStack->getCurrentRequest()->files = new FileBag();
+            $request->files = new FileBag();
+            // Ensure PHP globals reflect these changes.
+            $request->overrideGlobals();
           }
         }
       }

web/core/lib/Drupal/Core/Form/FormValidator.php

@@ -124,10 +124,8 @@ class FormValidator implements FormValidatorInterface {
    * {@inheritdoc}
    */
   public function setInvalidTokenError(FormStateInterface $form_state) {
-    $url = $this->requestStack->getCurrentRequest()->getRequestUri();
-
     // Setting this error will cause the form to fail validation.
-    $form_state->setErrorByName('form_token', $this->t('The form has become outdated. Copy any unsaved work in the form below and then <a href=":link">reload this page</a>.', [':link' => $url]));
+    $form_state->setErrorByName('form_token', $this->t('The form has become outdated. Press the back button, copy any unsaved work in the form, and then reload the page.'));
   }
 
   /**

web/core/lib/Drupal/Core/Menu/MenuTreeStorage.php

@@ -1459,6 +1459,7 @@ class MenuTreeStorage implements MenuTreeStorageInterface {
    *
    * @param array $definitions
    *   The new menu link definitions.
+   *
    * @return array
    *   A list of menu link IDs that no longer exist.
    */

web/core/lib/Drupal/Core/Menu/menu.api.php

@@ -329,7 +329,7 @@ function hook_menu_local_tasks_alter(&$data, $route_name, \Drupal\Core\Cache\Ref
       ],
   ];
   // The tab we're adding is dependent on a user's access to add content.
-  $cacheability->addCacheTags(['user.permissions']);
+  $cacheability->addCacheContexts(['user.permissions']);
 }
 
 /**

web/core/lib/Drupal/Core/Render/theme.api.php

@@ -274,9 +274,9 @@
  *   vectors while allowing a permissive list of HTML tags that are not XSS
  *   vectors. (For example, <script> and <style> are not allowed.) See
  *   \Drupal\Component\Utility\Xss::$adminTags for the list of allowed tags. If
- *   your markup needs any of the tags not in this whitelist, then you can
- *   implement a theme hook and/or an asset library. Alternatively, you can use
- *   the key #allowed_tags to alter which tags are filtered.
+ *   your markup needs any of the tags not in this list, then you can implement
+ *   a theme hook and/or an asset library. Alternatively, you can use the key
+ *   #allowed_tags to alter which tags are filtered.
  * - #plain_text: Specifies that the array provides text that needs to be
  *   escaped. This value takes precedence over #markup.
  * - #allowed_tags: If #markup is supplied, this can be used to change which

web/core/lib/Drupal/Core/Security/DoTrustedCallbackTrait.php

@@ -32,7 +32,7 @@ trait DoTrustedCallbackTrait {
    * @param string $error_type
    *   (optional) The type of error to trigger. One of:
    *   - TrustedCallbackInterface::THROW_EXCEPTION
-   *   - TrustedCallbackInterface::TRIGGER_DEPRECATION
+   *   - TrustedCallbackInterface::TRIGGER_WARNING
    *   - TrustedCallbackInterface::TRIGGER_SILENCED_DEPRECATION
    *   Defaults to TrustedCallbackInterface::THROW_EXCEPTION.
    * @param string $extra_trusted_interface

web/core/lib/Drupal/Core/StreamWrapper/StreamWrapperInterface.php

@@ -45,7 +45,7 @@ interface StreamWrapperInterface extends PhpStreamWrapperInterface {
   const READ = 0x0004;
 
   /**
-   * Wrapper is writeable.
+   * Wrapper is writable.
    */
   const WRITE = 0x0008;
 
@@ -67,12 +67,12 @@ interface StreamWrapperInterface extends PhpStreamWrapperInterface {
   const HIDDEN = 0x000C;
 
   /**
-   * Hidden, readable and writeable using local files.
+   * Hidden, readable and writable using local files.
    */
   const LOCAL_HIDDEN = 0x000D;
 
   /**
-   * Visible, readable and writeable.
+   * Visible, readable and writable.
    */
   const WRITE_VISIBLE = 0x001C;
 
@@ -91,7 +91,7 @@ interface StreamWrapperInterface extends PhpStreamWrapperInterface {
   const NORMAL = 0x001C;
 
   /**
-   * Visible, readable and writeable using local files.
+   * Visible, readable and writable using local files.
    */
   const LOCAL_NORMAL = 0x001D;
 

web/core/lib/Drupal/Core/Theme/Registry.php

@@ -802,6 +802,7 @@ class Registry implements DestructableInterface {
    *
    * @param $prefixes
    *   An array of function prefixes by which the list can be limited.
+   *
    * @return array
    *   Functions grouped by the first prefix.
    */

web/core/lib/Drupal/Core/Theme/ThemeManagerInterface.php

@@ -58,6 +58,7 @@ interface ThemeManagerInterface {
    *
    * @param \Drupal\Core\Theme\ActiveTheme $active_theme
    *   The new active theme.
+   *
    * @return $this
    */
   public function setActiveTheme(ActiveTheme $active_theme);

web/core/lib/Drupal/Core/Updater/Updater.php

@@ -291,7 +291,7 @@ class Updater {
       return $this->postInstallTasks();
     }
     catch (FileTransferException $e) {
-      throw new UpdaterFileTransferException("File Transfer failed, reason: '" . strtr($e->getMessage(), $e->arguments)) . "'";
+      throw new UpdaterFileTransferException("File Transfer failed, reason: '" . strtr($e->getMessage(), $e->arguments) . "'");
     }
   }
 

web/core/lib/Drupal/Core/Utility/UnroutedUrlAssembler.php

@@ -77,7 +77,7 @@ class UnroutedUrlAssembler implements UnroutedUrlAssemblerInterface {
     $parsed += ['query' => []];
     $options += ['query' => []];
 
-    $options['query'] = NestedArray::mergeDeep($parsed['query'], $options['query']);
+    $options['query'] = NestedArray::mergeDeepArray([$parsed['query'], $options['query']], TRUE);
 
     if ($parsed['fragment'] && !$options['fragment']) {
       $options['fragment'] = '#' . $parsed['fragment'];

web/core/lib/Drupal/Core/Validation/TranslatorInterface.php

@@ -25,6 +25,7 @@ interface TranslatorInterface {
    *   The domain for the message or null to use the default.
    * @param string|null $locale
    *   The locale or null to use the default.
+   *
    * @return string
    *   The translated string.
    *

web/core/misc/tableheader.es6.js

@@ -139,12 +139,12 @@
   // Bind to custom Drupal events.
   $(document).on({
     /**
-     * Recalculate columns width when window is resized and when show/hide
-     * weight is triggered.
+     * Recalculate columns width when window is resized, when show/hide weight
+     * is triggered, or when toolbar tray is toggled.
      *
      * @ignore
      */
-    'columnschange.TableHeader': tableHeaderResizeHandler,
+    'columnschange.TableHeader drupalToolbarTrayChange': tableHeaderResizeHandler,
 
     /**
      * Recalculate TableHeader.topOffset when viewport is resized.

web/core/misc/tableheader.js

@@ -77,7 +77,7 @@
   });
 
   $(document).on({
-    'columnschange.TableHeader': tableHeaderResizeHandler,
+    'columnschange.TableHeader drupalToolbarTrayChange': tableHeaderResizeHandler,
 
     'drupalViewportOffsetChange.TableHeader': tableHeaderOffsetChangeHandler
   });

web/core/modules/aggregator/src/Controller/AggregatorController.php

@@ -125,7 +125,7 @@ class AggregatorController extends ControllerBase {
         $next_update = $this->t('imminently');
       }
       elseif ($last_checked && $refresh_rate) {
-        $next_update = $next = $this->t('%time left', ['%time' => $this->dateFormatter->formatInterval($last_checked + $refresh_rate - REQUEST_TIME)]);
+        $next_update = $this->t('%time left', ['%time' => $this->dateFormatter->formatInterval($last_checked + $refresh_rate - REQUEST_TIME)]);
       }
       else {
         $next_update = $this->t('never');

web/core/modules/aggregator/tests/src/Functional/AggregatorTestBase.php

@@ -46,7 +46,12 @@ abstract class AggregatorTestBase extends BrowserTestBase {
       $this->drupalCreateContentType(['type' => 'article', 'name' => 'Article']);
     }
 
-    $this->adminUser = $this->drupalCreateUser(['access administration pages', 'administer news feeds', 'access news feeds', 'create article content']);
+    $this->adminUser = $this->drupalCreateUser([
+      'access administration pages',
+      'administer news feeds',
+      'access news feeds',
+      'create article content',
+    ]);
     $this->drupalLogin($this->adminUser);
     $this->drupalPlaceBlock('local_tasks_block');
   }

web/core/modules/aggregator/tests/src/Functional/FeedLanguageTest.php

@@ -55,7 +55,13 @@ class FeedLanguageTest extends AggregatorTestBase {
    * Tests creation of feeds with a language.
    */
   public function testFeedLanguage() {
-    $admin_user = $this->drupalCreateUser(['administer languages', 'access administration pages', 'administer news feeds', 'access news feeds', 'create article content']);
+    $admin_user = $this->drupalCreateUser([
+      'administer languages',
+      'access administration pages',
+      'administer news feeds',
+      'access news feeds',
+      'create article content',
+    ]);
     $this->drupalLogin($admin_user);
 
     // Enable language selection for feeds.

web/core/modules/aggregator/tests/src/Functional/ImportOpmlTest.php

@@ -29,7 +29,12 @@ class ImportOpmlTest extends AggregatorTestBase {
   protected function setUp() {
     parent::setUp();
 
-    $admin_user = $this->drupalCreateUser(['administer news feeds', 'access news feeds', 'create article content', 'administer blocks']);
+    $admin_user = $this->drupalCreateUser([
+      'administer news feeds',
+      'access news feeds',
+      'create article content',
+      'administer blocks',
+    ]);
     $this->drupalLogin($admin_user);
   }
 

web/core/modules/basic_auth/src/Authentication/Provider/BasicAuth.php

@@ -128,7 +128,7 @@ class BasicAuth implements AuthenticationProviderInterface, AuthenticationProvid
     }
     // Always register an IP-based failed login event.
     $this->flood->register('basic_auth.failed_login_ip', $flood_config->get('ip_window'));
-    return [];
+    return NULL;
   }
 
   /**

web/core/modules/basic_auth/tests/src/Functional/BasicAuthTest.php

@@ -76,7 +76,7 @@ class BasicAuthTest extends BrowserTestBase {
 
     // Ensure that a route without basic auth defined doesn't allow login.
     $this->basicAuthGet(Url::fromRoute('system.admin'), $account->getAccountName(), $account->pass_raw);
-    $this->assertNoLink('Log out', 'User is not logged in');
+    $this->assertSession()->linkNotExists('Log out', 'User is not logged in');
     $this->assertSession()->statusCodeEquals(403);
     $this->mink->resetSessions();
 

web/core/modules/big_pipe/tests/src/Functional/BigPipeTest.php

@@ -192,7 +192,9 @@ class BigPipeTest extends BrowserTestBase {
 
     // Verify that the two expected exceptions are logged as errors.
     $this->assertEqual($log_count + 2, $connection->query('SELECT COUNT(*) FROM {watchdog}')->fetchField(), 'Two new watchdog entries.');
-    $records = $connection->query('SELECT * FROM {watchdog} ORDER BY wid DESC LIMIT 2')->fetchAll();
+    // Using the method queryRange() allows contrib database drivers the ability
+    // to insert their own limit and offset functionality.
+    $records = $connection->queryRange('SELECT * FROM {watchdog} ORDER BY wid DESC', 0, 2)->fetchAll();
     $this->assertEqual(RfcLogLevel::ERROR, $records[0]->severity);
     $this->assertStringContainsString('Oh noes!', (string) unserialize($records[0]->variables)['@message']);
     $this->assertEqual(RfcLogLevel::ERROR, $records[1]->severity);

web/core/modules/block/tests/src/Functional/BlockAdminThemeTest.php

@@ -28,7 +28,10 @@ class BlockAdminThemeTest extends BrowserTestBase {
    */
   public function testAdminTheme() {
     // Create administrative user.
-    $admin_user = $this->drupalCreateUser(['administer blocks', 'administer themes']);
+    $admin_user = $this->drupalCreateUser([
+      'administer blocks',
+      'administer themes',
+    ]);
     $this->drupalLogin($admin_user);
 
     // Ensure that access to block admin page is denied when theme is not

web/core/modules/block/tests/src/Functional/BlockCacheTest.php

@@ -56,7 +56,10 @@ class BlockCacheTest extends BrowserTestBase {
     parent::setUp();
 
     // Create an admin user, log in and enable test blocks.
-    $this->adminUser = $this->drupalCreateUser(['administer blocks', 'access administration pages']);
+    $this->adminUser = $this->drupalCreateUser([
+      'administer blocks',
+      'access administration pages',
+    ]);
     $this->drupalLogin($this->adminUser);
 
     // Create additional users to test caching modes.

web/core/modules/block/tests/src/Functional/BlockDemoTest.php

@@ -28,7 +28,10 @@ class BlockDemoTest extends BrowserTestBase {
    */
   public function testBlockDemo() {
     // Create administrative user.
-    $admin_user = $this->drupalCreateUser(['administer blocks', 'administer themes']);
+    $admin_user = $this->drupalCreateUser([
+      'administer blocks',
+      'administer themes',
+    ]);
     $this->drupalLogin($admin_user);
 
     // Confirm we have access to the block demo page for the default theme.

web/core/modules/block/tests/src/Functional/BlockLanguageTest.php

@@ -33,7 +33,10 @@ class BlockLanguageTest extends BrowserTestBase {
   protected function setUp() {
     parent::setUp();
 
-    $this->adminUser = $this->drupalCreateUser(['administer blocks', 'administer languages']);
+    $this->adminUser = $this->drupalCreateUser([
+      'administer blocks',
+      'administer languages',
+    ]);
     $this->drupalLogin($this->adminUser);
 
     // Add predefined language.

web/core/modules/block/tests/src/Functional/BlockUiTest.php

@@ -152,9 +152,9 @@ class BlockUiTest extends BrowserTestBase {
     \Drupal::service('theme_installer')->install(['stable', 'stark']);
     $this->drupalGet('admin/structure/block');
     $theme_handler = \Drupal::service('theme_handler');
-    $this->assertLink($theme_handler->getName('classy'));
-    $this->assertLink($theme_handler->getName('stark'));
-    $this->assertNoLink($theme_handler->getName('stable'));
+    $this->assertSession()->linkExists($theme_handler->getName('classy'));
+    $this->assertSession()->linkExists($theme_handler->getName('stark'));
+    $this->assertSession()->linkNotExists($theme_handler->getName('stable'));
 
     // Ensure that a hidden theme cannot use the block demo page.
     $this->drupalGet('admin/structure/block/list/stable');
@@ -166,7 +166,7 @@ class BlockUiTest extends BrowserTestBase {
     \Drupal::service('router.builder')->rebuildIfNeeded();
     $this->drupalPlaceBlock('local_tasks_block', ['region' => 'header', 'theme' => 'stable']);
     $this->drupalGet('admin/structure/block');
-    $this->assertLink($theme_handler->getName('stable'));
+    $this->assertSession()->linkExists($theme_handler->getName('stable'));
     $this->drupalGet('admin/structure/block/list/stable');
     $this->assertSession()->statusCodeEquals(200);
   }

web/core/modules/block/tests/src/Functional/BlockXssTest.php

@@ -32,7 +32,10 @@ class BlockXssTest extends BrowserTestBase {
    * Tests that nothing is escaped other than the blocks explicitly tested.
    */
   public function testNoUnexpectedEscaping() {
-    $this->drupalLogin($this->drupalCreateUser(['administer blocks', 'access administration pages']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer blocks',
+      'access administration pages',
+    ]));
     $this->drupalGet(Url::fromRoute('block.admin_display'));
     $this->clickLink('Place block');
     $this->assertNoEscaped('<');
@@ -49,7 +52,10 @@ class BlockXssTest extends BrowserTestBase {
     $this->drupalGet('');
     $this->assertNoRaw('<script>alert("XSS label");</script>', 'The block title was properly sanitized when rendered.');
 
-    $this->drupalLogin($this->drupalCreateUser(['administer blocks', 'access administration pages']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer blocks',
+      'access administration pages',
+    ]));
     $default_theme = $this->config('system.theme')->get('default');
     $this->drupalGet('admin/structure/block/list/' . $default_theme);
     $this->assertNoRaw("<script>alert('XSS subject');</script>", 'The block title was properly sanitized in Block Plugin UI Admin page.');
@@ -61,7 +67,10 @@ class BlockXssTest extends BrowserTestBase {
   public function testXssInCategory() {
     $this->container->get('module_installer')->install(['block_test']);
     $this->drupalPlaceBlock('test_xss_title');
-    $this->drupalLogin($this->drupalCreateUser(['administer blocks', 'access administration pages']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer blocks',
+      'access administration pages',
+    ]));
     $this->drupalGet(Url::fromRoute('block.admin_display'));
     $this->clickLink('Place block');
     $this->assertNoRaw("<script>alert('XSS category');</script>");

web/core/modules/block/tests/src/Functional/NonDefaultBlockAdminTest.php

@@ -36,7 +36,10 @@ class NonDefaultBlockAdminTest extends BrowserTestBase {
    * Test non-default theme admin.
    */
   public function testNonDefaultBlockAdmin() {
-    $admin_user = $this->drupalCreateUser(['administer blocks', 'administer themes']);
+    $admin_user = $this->drupalCreateUser([
+      'administer blocks',
+      'administer themes',
+    ]);
     $this->drupalLogin($admin_user);
     $new_theme = 'bartik';
     \Drupal::service('theme_installer')->install([$new_theme]);

web/core/modules/block/tests/src/Functional/Views/DisplayBlockTest.php

@@ -65,7 +65,10 @@ class DisplayBlockTest extends ViewTestBase {
    * Tests default and custom block categories.
    */
   public function testBlockCategory() {
-    $this->drupalLogin($this->drupalCreateUser(['administer views', 'administer blocks']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer views',
+      'administer blocks',
+    ]));
 
     // Create a new view in the UI.
     $edit = [];
@@ -368,7 +371,11 @@ class DisplayBlockTest extends ViewTestBase {
    * Tests the contextual links on a Views block.
    */
   public function testBlockContextualLinks() {
-    $this->drupalLogin($this->drupalCreateUser(['administer views', 'access contextual links', 'administer blocks']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer views',
+      'access contextual links',
+      'administer blocks',
+    ]));
     $block = $this->drupalPlaceBlock('views_block:test_view_block-block_1');
     $cached_block = $this->drupalPlaceBlock('views_block:test_view_block-block_1');
     $this->drupalGet('test-page');

web/core/modules/block_content/src/Entity/BlockContentType.php

@@ -11,14 +11,13 @@ use Drupal\block_content\BlockContentTypeInterface;
  * @ConfigEntityType(
  *   id = "block_content_type",
  *   label = @Translation("Custom block type"),
- *   label_collection = @Translation("Custom block types"),
+ *   label_collection = @Translation("Custom block library"),
  *   label_singular = @Translation("custom block type"),
  *   label_plural = @Translation("custom block types"),
  *   label_count = @PluralTranslation(
  *     singular = "@count custom block type",
  *     plural = "@count custom block types",
  *   ),
- *   label_collection = @Translation("Custom block library"),
  *   handlers = {
  *     "form" = {
  *       "default" = "Drupal\block_content\BlockContentTypeForm",

web/core/modules/block_content/tests/src/Functional/BlockContentListTest.php

@@ -31,7 +31,10 @@ class BlockContentListTest extends BlockContentTestBase {
    * Tests the custom block listing page.
    */
   public function testListing() {
-    $this->drupalLogin($this->drupalCreateUser(['administer blocks', 'translate configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer blocks',
+      'translate configuration',
+    ]));
     $this->drupalGet('admin/structure/block/block-content');
 
     // Test for the page title.
@@ -55,7 +58,7 @@ class BlockContentListTest extends BlockContentTestBase {
     $new_label = 'Albatross';
     // Add a new entity using the operations link.
     $link_text = t('Add custom block');
-    $this->assertLink($link_text);
+    $this->assertSession()->linkExists($link_text);
     $this->clickLink($link_text);
     $this->assertSession()->statusCodeEquals(200);
     $edit = [];

web/core/modules/block_content/tests/src/Functional/BlockContentListViewsTest.php

@@ -34,7 +34,10 @@ class BlockContentListViewsTest extends BlockContentTestBase {
    * Tests the custom block listing page.
    */
   public function testListing() {
-    $this->drupalLogin($this->drupalCreateUser(['administer blocks', 'translate configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer blocks',
+      'translate configuration',
+    ]));
     $this->drupalGet('admin/structure/block/block-content');
 
     // Test for the page title.
@@ -67,7 +70,7 @@ class BlockContentListViewsTest extends BlockContentTestBase {
     $new_label = 'Albatross';
     // Add a new entity using the operations link.
     $link_text = t('Add custom block');
-    $this->assertLink($link_text);
+    $this->assertSession()->linkExists($link_text);
     $this->clickLink($link_text);
     $this->assertSession()->statusCodeEquals(200);
     $edit = [];
@@ -123,7 +126,7 @@ class BlockContentListViewsTest extends BlockContentTestBase {
 
     // Confirm that the empty text is displayed.
     $this->assertText('There are no custom blocks available.');
-    $this->assertLink('custom block');
+    $this->assertSession()->linkExists('custom block');
 
     $block_content = BlockContent::create([
       'info' => 'Non-reusable block',

web/core/modules/book/tests/src/Functional/BookBreadcrumbTest.php

@@ -53,8 +53,24 @@ class BookBreadcrumbTest extends BrowserTestBase {
     $this->drupalPlaceBlock('page_title_block');
 
     // Create users.
-    $this->bookAuthor = $this->drupalCreateUser(['create new books', 'create book content', 'edit own book content', 'add content to books']);
-    $this->adminUser = $this->drupalCreateUser(['create new books', 'create book content', 'edit any book content', 'delete any book content', 'add content to books', 'administer blocks', 'administer permissions', 'administer book outlines', 'administer content types', 'administer site configuration']);
+    $this->bookAuthor = $this->drupalCreateUser([
+      'create new books',
+      'create book content',
+      'edit own book content',
+      'add content to books',
+    ]);
+    $this->adminUser = $this->drupalCreateUser([
+      'create new books',
+      'create book content',
+      'edit any book content',
+      'delete any book content',
+      'add content to books',
+      'administer blocks',
+      'administer permissions',
+      'administer book outlines',
+      'administer content types',
+      'administer site configuration',
+    ]);
   }
 
   /**

web/core/modules/book/tests/src/Functional/BookContentModerationTest.php

@@ -46,7 +46,16 @@ class BookContentModerationTest extends BrowserTestBase {
     $workflow->save();
 
     // We need a user with additional content moderation permissions.
-    $this->bookAuthor = $this->drupalCreateUser(['create new books', 'create book content', 'edit own book content', 'add content to books', 'access printer-friendly version', 'view any unpublished content', 'use editorial transition create_new_draft', 'use editorial transition publish']);
+    $this->bookAuthor = $this->drupalCreateUser([
+      'create new books',
+      'create book content',
+      'edit own book content',
+      'add content to books',
+      'access printer-friendly version',
+      'view any unpublished content',
+      'use editorial transition create_new_draft',
+      'use editorial transition publish',
+    ]);
   }
 
   /**

web/core/modules/book/tests/src/Functional/BookTest.php

@@ -61,10 +61,32 @@ class BookTest extends BrowserTestBase {
     node_access_rebuild();
 
     // Create users.
-    $this->bookAuthor = $this->drupalCreateUser(['create new books', 'create book content', 'edit own book content', 'add content to books']);
-    $this->webUser = $this->drupalCreateUser(['access printer-friendly version', 'node test view']);
-    $this->webUserWithoutNodeAccess = $this->drupalCreateUser(['access printer-friendly version']);
-    $this->adminUser = $this->drupalCreateUser(['create new books', 'create book content', 'edit any book content', 'delete any book content', 'add content to books', 'administer blocks', 'administer permissions', 'administer book outlines', 'node test view', 'administer content types', 'administer site configuration']);
+    $this->bookAuthor = $this->drupalCreateUser([
+      'create new books',
+      'create book content',
+      'edit own book content',
+      'add content to books',
+    ]);
+    $this->webUser = $this->drupalCreateUser([
+      'access printer-friendly version',
+      'node test view',
+    ]);
+    $this->webUserWithoutNodeAccess = $this->drupalCreateUser([
+      'access printer-friendly version',
+    ]);
+    $this->adminUser = $this->drupalCreateUser([
+      'create new books',
+      'create book content',
+      'edit any book content',
+      'delete any book content',
+      'add content to books',
+      'administer blocks',
+      'administer permissions',
+      'administer book outlines',
+      'node test view',
+      'administer content types',
+      'administer site configuration',
+    ]);
   }
 
   /**
@@ -220,7 +242,7 @@ class BookTest extends BrowserTestBase {
 
     // Load the book and verify there is no printer-friendly version link.
     $this->drupalGet('node/' . $this->book->id());
-    $this->assertNoLink(t('Printer-friendly version'), 'Anonymous user is not shown link to printer-friendly version.');
+    $this->assertSession()->linkNotExists(t('Printer-friendly version'), 'Anonymous user is not shown link to printer-friendly version.');
 
     // Try getting the URL directly, and verify it fails.
     $this->drupalGet('book/export/html/' . $this->book->id());
@@ -402,13 +424,13 @@ class BookTest extends BrowserTestBase {
     // Create new node not yet a book.
     $empty_book = $this->drupalCreateNode(['type' => 'book']);
     $this->drupalGet('node/' . $empty_book->id() . '/outline');
-    $this->assertNoLink(t('Book outline'), 'Book Author is not allowed to outline');
+    $this->assertSession()->linkNotExists(t('Book outline'), 'Book Author is not allowed to outline');
 
     $this->drupalLogin($this->adminUser);
     $this->drupalGet('node/' . $empty_book->id() . '/outline');
     $this->assertRaw(t('Book outline'));
     $this->assertOptionSelected('edit-book-bid', 0, 'Node does not belong to a book');
-    $this->assertNoLink(t('Remove from book outline'));
+    $this->assertSession()->linkNotExists(t('Remove from book outline'));
 
     $edit = [];
     $edit['book[bid]'] = '1';
@@ -557,7 +579,11 @@ class BookTest extends BrowserTestBase {
     $this->createBook();
 
     // Create administrator user.
-    $administratorUser = $this->drupalCreateUser(['administer blocks', 'administer nodes', 'bypass node access']);
+    $administratorUser = $this->drupalCreateUser([
+      'administer blocks',
+      'administer nodes',
+      'bypass node access',
+    ]);
     $this->drupalLogin($administratorUser);
 
     // Enable the block with "Show block only on book pages" mode.

web/core/modules/book/tests/src/Functional/Views/BookRelationshipTest.php

@@ -153,7 +153,7 @@ class BookRelationshipTest extends ViewTestBase {
       $this->drupalGet('test-book/' . $nodes[$i]->id());
 
       for ($j = 0; $j < $i; $j++) {
-        $this->assertLink($nodes[$j]->label());
+        $this->assertSession()->linkExists($nodes[$j]->label());
       }
     }
   }

web/core/modules/ckeditor/src/CKEditorPluginInterface.php

@@ -45,6 +45,7 @@ interface CKEditorPluginInterface extends PluginInspectionInterface {
    *
    * @param \Drupal\editor\Entity\Editor $editor
    *   A configured text editor object.
+   *
    * @return array
    *   An unindexed array of plugin names this plugin requires. Each plugin is
    *   is identified by its annotated ID.
@@ -59,6 +60,7 @@ interface CKEditorPluginInterface extends PluginInspectionInterface {
    *
    * @param \Drupal\editor\Entity\Editor $editor
    *   A configured text editor object.
+   *
    * @return array
    *   An array of libraries suitable for usage in a render API #attached
    *   property.
@@ -91,6 +93,7 @@ interface CKEditorPluginInterface extends PluginInspectionInterface {
    *
    * @param \Drupal\editor\Entity\Editor $editor
    *   A configured text editor object.
+   *
    * @return array
    *   A keyed array, whose keys will end up as keys under CKEDITOR.config.
    */

web/core/modules/ckeditor/src/CKEditorPluginManager.php

@@ -60,6 +60,7 @@ class CKEditorPluginManager extends DefaultPluginManager {
    * @param bool $include_internal_plugins
    *   Defaults to FALSE. When set to TRUE, plugins whose isInternal() method
    *   returns TRUE will also be included.
+   *
    * @return array
    *   A list of the enabled CKEditor plugins, with the plugin IDs as keys and
    *   the Drupal root-relative plugin files as values.

web/core/modules/ckeditor/src/Plugin/CKEditorPlugin/StylesCombo.php

@@ -117,6 +117,7 @@ class StylesCombo extends CKEditorPluginBase implements CKEditorPluginConfigurab
    *
    * @param string $styles
    *   The "styles" setting.
+   *
    * @return array|false
    *   An array containing the "stylesSet" configuration, or FALSE when the
    *   syntax is invalid.

web/core/modules/ckeditor/src/Plugin/Editor/CKEditor.php

@@ -403,6 +403,7 @@ class CKEditor extends EditorBase implements ContainerFactoryPluginInterface {
    *
    * @param \Drupal\editor\Entity\Editor $editor
    *   A configured text editor object.
+   *
    * @return array
    *   An array containing the "toolbar" configuration.
    */
@@ -426,6 +427,7 @@ class CKEditor extends EditorBase implements ContainerFactoryPluginInterface {
    *
    * @param \Drupal\editor\Entity\Editor $editor
    *   A configured text editor object.
+   *
    * @return array
    *   An array containing the "contentsCss" configuration.
    */

web/core/modules/ckeditor/tests/src/Functional/CKEditorLoadingTest.php

@@ -72,8 +72,16 @@ class CKEditorLoadingTest extends BrowserTestBase {
       'name' => 'Article',
     ]);
 
-    $this->untrustedUser = $this->drupalCreateUser(['create article content', 'edit any article content']);
-    $this->normalUser = $this->drupalCreateUser(['create article content', 'edit any article content', 'use text format filtered_html', 'use text format full_html']);
+    $this->untrustedUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+    ]);
+    $this->normalUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'use text format filtered_html',
+      'use text format full_html',
+    ]);
   }
 
   /**

web/core/modules/ckeditor/tests/src/Functional/CKEditorStylesComboTranslationTest.php

@@ -57,7 +57,10 @@ class CKEditorStylesComboTranslationTest extends BrowserTestBase {
     ]);
     $editor->save();
 
-    $this->adminUser = $this->drupalCreateUser(['administer filters', 'translate configuration']);
+    $this->adminUser = $this->drupalCreateUser([
+      'administer filters',
+      'translate configuration',
+    ]);
 
     ConfigurableLanguage::createFromLangcode('de')->save();
   }

web/core/modules/comment/src/CommentStorageInterface.php

@@ -75,6 +75,7 @@ interface CommentStorageInterface extends ContentEntityStorageInterface {
    *
    * @param \Drupal\comment\CommentInterface[] $comments
    *   An array of comment entities keyed by their ids.
+   *
    * @return array
    *   The entity ids of the passed comment entities' children as an array.
    */

web/core/modules/comment/tests/src/Functional/CommentAnonymousTest.php

@@ -176,7 +176,7 @@ class CommentAnonymousTest extends CommentTestBase {
     // "Login or register to post comments" type link may be shown.
     $this->drupalGet('node/' . $this->node->id());
     $this->assertSession()->responseNotMatches('@<h2[^>]*>Comments</h2>@', 'Comments were not displayed.');
-    $this->assertNoLink('Add new comment', 'Link to add comment was found.');
+    $this->assertSession()->linkNotExists('Add new comment', 'Link to add comment was found.');
 
     // Attempt to view node-comment form while disallowed.
     $this->drupalGet('comment/reply/node/' . $this->node->id() . '/comment');
@@ -189,8 +189,8 @@ class CommentAnonymousTest extends CommentTestBase {
     ]);
     $this->drupalGet('node/' . $this->node->id());
     $this->assertPattern('@<h2[^>]*>Comments</h2>@', 'Comments were displayed.');
-    $this->assertLink('Log in', 1, 'Link to login was found.');
-    $this->assertLink('register', 1, 'Link to register was found.');
+    $this->assertSession()->linkExists('Log in', 1, 'Link to login was found.');
+    $this->assertSession()->linkExists('register', 1, 'Link to register was found.');
 
     user_role_change_permissions(RoleInterface::ANONYMOUS_ID, [
       'access comments' => FALSE,

web/core/modules/comment/tests/src/Functional/CommentBookTest.php

@@ -60,7 +60,11 @@ class CommentBookTest extends BrowserTestBase {
     ]);
     $comment->save();
 
-    $commenting_user = $this->drupalCreateUser(['access printer-friendly version', 'access comments', 'post comments']);
+    $commenting_user = $this->drupalCreateUser([
+      'access printer-friendly version',
+      'access comments',
+      'post comments',
+    ]);
     $this->drupalLogin($commenting_user);
 
     $this->drupalGet('node/' . $book_node->id());

web/core/modules/comment/tests/src/Functional/CommentFieldsTest.php

@@ -191,7 +191,10 @@ class CommentFieldsTest extends CommentTestBase {
    */
   public function testCommentInstallAfterContentModule() {
     // Create a user to do module administration.
-    $this->adminUser = $this->drupalCreateUser(['access administration pages', 'administer modules']);
+    $this->adminUser = $this->drupalCreateUser([
+      'access administration pages',
+      'administer modules',
+    ]);
     $this->drupalLogin($this->adminUser);
 
     // Drop default comment field added in CommentTestBase::setup().
@@ -233,7 +236,12 @@ class CommentFieldsTest extends CommentTestBase {
     // Try to post a comment on each node. A failure will be triggered if the
     // comment body is missing on one of these forms, due to postComment()
     // asserting that the body is actually posted correctly.
-    $this->webUser = $this->drupalCreateUser(['access content', 'access comments', 'post comments', 'skip comment approval']);
+    $this->webUser = $this->drupalCreateUser([
+      'access content',
+      'access comments',
+      'post comments',
+      'skip comment approval',
+    ]);
     $this->drupalLogin($this->webUser);
     $this->postComment($book_node, $this->randomMachineName(), $this->randomMachineName());
   }

web/core/modules/comment/tests/src/Functional/CommentLanguageTest.php

@@ -45,7 +45,17 @@ class CommentLanguageTest extends BrowserTestBase {
     $this->drupalCreateContentType(['type' => 'article', 'name' => 'Article']);
 
     // Create and log in user.
-    $admin_user = $this->drupalCreateUser(['administer site configuration', 'administer languages', 'access administration pages', 'administer content types', 'administer comments', 'create article content', 'access comments', 'post comments', 'skip comment approval']);
+    $admin_user = $this->drupalCreateUser([
+      'administer site configuration',
+      'administer languages',
+      'access administration pages',
+      'administer content types',
+      'administer comments',
+      'create article content',
+      'access comments',
+      'post comments',
+      'skip comment approval',
+    ]);
     $this->drupalLogin($admin_user);
 
     // Add language.

web/core/modules/comment/tests/src/Functional/CommentLinksAlterTest.php

@@ -34,7 +34,7 @@ class CommentLinksAlterTest extends CommentTestBase {
 
     $this->drupalGet('node/' . $this->node->id());
 
-    $this->assertLink(t('Report'));
+    $this->assertSession()->linkExists(t('Report'));
   }
 
 }

web/core/modules/comment/tests/src/Functional/CommentLinksTest.php

@@ -101,9 +101,9 @@ class CommentLinksTest extends CommentTestBase {
       // In teaser view, a link containing the comment count is always
       // expected.
       if ($path == 'node') {
-        $this->assertLink(t('1 comment'));
+        $this->assertSession()->linkExists(t('1 comment'));
       }
-      $this->assertLink('Add new comment');
+      $this->assertSession()->linkExists('Add new comment');
     }
 
     $display_repository = $this->container->get('entity_display.repository');
@@ -133,13 +133,13 @@ class CommentLinksTest extends CommentTestBase {
       ->removeComponent('links')
       ->save();
     $this->drupalGet($this->node->toUrl());
-    $this->assertNoLink('1 comment');
-    $this->assertNoLink('Add new comment');
+    $this->assertSession()->linkNotExists('1 comment');
+    $this->assertSession()->linkNotExists('Add new comment');
 
     // Visit the full node, make sure there are links for the comment.
     $this->drupalGet('node/' . $this->node->id());
     $this->assertText($comment->getSubject());
-    $this->assertLink('Reply');
+    $this->assertSession()->linkExists('Reply');
 
     // Make sure we can hide comment links.
     $display_repository->getViewDisplay('comment', 'comment')
@@ -147,7 +147,7 @@ class CommentLinksTest extends CommentTestBase {
       ->save();
     $this->drupalGet('node/' . $this->node->id());
     $this->assertText($comment->getSubject());
-    $this->assertNoLink('Reply');
+    $this->assertSession()->linkNotExists('Reply');
   }
 
 }

web/core/modules/comment/tests/src/Functional/CommentNewIndicatorTest.php

@@ -60,8 +60,8 @@ class CommentNewIndicatorTest extends CommentTestBase {
     // node.
     $this->drupalLogin($this->adminUser);
     $this->drupalGet('node');
-    $this->assertNoLink(t('@count comments', ['@count' => 0]));
-    $this->assertLink(t('Read more'));
+    $this->assertSession()->linkNotExists(t('@count comments', ['@count' => 0]));
+    $this->assertSession()->linkExists(t('Read more'));
     // Verify the data-history-node-last-comment-timestamp attribute, which is
     // used by the drupal.node-new-comments-link library to determine whether
     // a "x new comments" link might be necessary or not. We do this in

web/core/modules/comment/tests/src/Functional/CommentNonNodeTest.php

@@ -355,7 +355,7 @@ class CommentNonNodeTest extends BrowserTestBase {
     // Attempt to view comments while disallowed.
     $this->drupalGet('entity-test/' . $this->entity->id());
     $this->assertSession()->responseNotMatches('@<h2[^>]*>Comments</h2>@', 'Comments were not displayed.');
-    $this->assertNoLink('Add new comment', 'Link to add comment was found.');
+    $this->assertSession()->linkNotExists('Add new comment', 'Link to add comment was found.');
 
     // Attempt to view test entity comment form while disallowed.
     $this->drupalGet('comment/reply/entity_test/' . $this->entity->id() . '/comment');
@@ -371,8 +371,8 @@ class CommentNonNodeTest extends BrowserTestBase {
     ]);
     $this->drupalGet('entity_test/' . $this->entity->id());
     $this->assertPattern('@<h2[^>]*>Comments</h2>@', 'Comments were displayed.');
-    $this->assertLink('Log in', 0, 'Link to login was found.');
-    $this->assertLink('register', 0, 'Link to register was found.');
+    $this->assertSession()->linkExists('Log in', 0, 'Link to login was found.');
+    $this->assertSession()->linkExists('register', 0, 'Link to register was found.');
     $this->assertNoFieldByName('subject[0][value]', '', 'Subject field not found.');
     $this->assertNoFieldByName('comment_body[0][value]', '', 'Comment field not found.');
 

web/core/modules/comment/tests/src/Functional/CommentPreviewTest.php

@@ -128,7 +128,12 @@ class CommentPreviewTest extends CommentTestBase {
    * Tests comment edit, preview, and save.
    */
   public function testCommentEditPreviewSave() {
-    $web_user = $this->drupalCreateUser(['access comments', 'post comments', 'skip comment approval', 'edit own comments']);
+    $web_user = $this->drupalCreateUser([
+      'access comments',
+      'post comments',
+      'skip comment approval',
+      'edit own comments',
+    ]);
     $this->drupalLogin($this->adminUser);
     $this->setCommentPreview(DRUPAL_OPTIONAL);
     $this->setCommentForm(TRUE);

web/core/modules/config/tests/src/Functional/ConfigDependencyWebTest.php

@@ -35,7 +35,9 @@ class ConfigDependencyWebTest extends BrowserTestBase {
    * @see \Drupal\Core\Config\Entity\ConfigDependencyDeleteFormTrait
    */
   public function testConfigDependencyDeleteFormTrait() {
-    $this->drupalLogin($this->drupalCreateUser(['administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer site configuration',
+    ]));
 
     /** @var \Drupal\Core\Config\Entity\ConfigEntityStorage $storage */
     $storage = $this->container->get('entity_type.manager')->getStorage('config_test');

web/core/modules/config/tests/src/Functional/ConfigEntityFormOverrideTest.php

@@ -25,7 +25,9 @@ class ConfigEntityFormOverrideTest extends BrowserTestBase {
    * Tests that overrides do not affect forms or listing screens.
    */
   public function testFormsWithOverrides() {
-    $this->drupalLogin($this->drupalCreateUser(['administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer site configuration',
+    ]));
 
     $original_label = 'Default';
     $overridden_label = 'Overridden label';

web/core/modules/config/tests/src/Functional/ConfigEntityListMultilingualTest.php

@@ -41,7 +41,10 @@ class ConfigEntityListMultilingualTest extends BrowserTestBase {
    */
   public function testListUI() {
     // Log in as an administrative user to access the full menu trail.
-    $this->drupalLogin($this->drupalCreateUser(['access administration pages', 'administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'access administration pages',
+      'administer site configuration',
+    ]));
 
     // Get the list page.
     $this->drupalGet('admin/structure/config_test');

web/core/modules/config/tests/src/Functional/ConfigEntityListTest.php

@@ -156,7 +156,10 @@ class ConfigEntityListTest extends BrowserTestBase {
    */
   public function testListUI() {
     // Log in as an administrative user to access the full menu trail.
-    $this->drupalLogin($this->drupalCreateUser(['access administration pages', 'administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'access administration pages',
+      'administer site configuration',
+    ]));
 
     // Get the list callback page.
     $this->drupalGet('admin/structure/config_test');
@@ -190,7 +193,7 @@ class ConfigEntityListTest extends BrowserTestBase {
     $this->assertNotEmpty($elements[2]->find('xpath', '//ul'), 'Operations list found.');
 
     // Add a new entity using the operations link.
-    $this->assertLink('Add test configuration');
+    $this->assertSession()->linkExists('Add test configuration');
     $this->clickLink('Add test configuration');
     $this->assertSession()->statusCodeEquals(200);
     $edit = [
@@ -254,7 +257,9 @@ class ConfigEntityListTest extends BrowserTestBase {
    * Test paging.
    */
   public function testPager() {
-    $this->drupalLogin($this->drupalCreateUser(['administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer site configuration',
+    ]));
 
     $storage = \Drupal::service('entity_type.manager')->getListBuilder('config_test')->getStorage();
 

web/core/modules/config/tests/src/Functional/ConfigEntityStatusUITest.php

@@ -27,7 +27,9 @@ class ConfigEntityStatusUITest extends BrowserTestBase {
    * Tests status operations.
    */
   public function testCRUD() {
-    $this->drupalLogin($this->drupalCreateUser(['administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer site configuration',
+    ]));
 
     $id = strtolower($this->randomMachineName());
     $edit = [

web/core/modules/config/tests/src/Functional/ConfigEntityTest.php

@@ -236,7 +236,9 @@ class ConfigEntityTest extends BrowserTestBase {
    * Tests CRUD operations through the UI.
    */
   public function testCRUDUI() {
-    $this->drupalLogin($this->drupalCreateUser(['administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer site configuration',
+    ]));
 
     $id = strtolower($this->randomMachineName());
     $label1 = $this->randomMachineName();

web/core/modules/config/tests/src/Functional/ConfigFormOverrideTest.php

@@ -21,7 +21,10 @@ class ConfigFormOverrideTest extends BrowserTestBase {
    * Tests that overrides do not affect forms.
    */
   public function testFormsWithOverrides() {
-    $this->drupalLogin($this->drupalCreateUser(['access administration pages', 'administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'access administration pages',
+      'administer site configuration',
+    ]));
 
     $overridden_name = 'Site name global conf override';
 

web/core/modules/config/tests/src/Functional/ConfigInstallWebTest.php

@@ -34,7 +34,11 @@ class ConfigInstallWebTest extends BrowserTestBase {
   protected function setUp() {
     parent::setUp();
 
-    $this->adminUser = $this->drupalCreateUser(['administer modules', 'administer themes', 'administer site configuration']);
+    $this->adminUser = $this->drupalCreateUser([
+      'administer modules',
+      'administer themes',
+      'administer site configuration',
+    ]);
 
     // Ensure the global variable being asserted by this test does not exist;
     // a previous test executed in this request/process might have set it.

web/core/modules/config/tests/src/Functional/ConfigLanguageOverrideWebTest.php

@@ -40,7 +40,10 @@ class ConfigLanguageOverrideWebTest extends BrowserTestBase {
    * Tests translating the site name.
    */
   public function testSiteNameTranslation() {
-    $adminUser = $this->drupalCreateUser(['administer site configuration', 'administer languages']);
+    $adminUser = $this->drupalCreateUser([
+      'administer site configuration',
+      'administer languages',
+    ]);
     $this->drupalLogin($adminUser);
 
     // Add a custom language.

web/core/modules/config/tests/src/FunctionalJavascript/ConfigEntityTest.php

@@ -25,7 +25,9 @@ class ConfigEntityTest extends WebDriverTestBase {
    * Tests ajax operations through the UI on 'Add' page.
    */
   public function testAjaxOnAddPage() {
-    $this->drupalLogin($this->drupalCreateUser(['administer site configuration']));
+    $this->drupalLogin($this->drupalCreateUser([
+      'administer site configuration',
+    ]));
 
     $page = $this->getSession()->getPage();
     $assert_session = $this->assertSession();