Update to Drupal 8.2.6. For more information, see https://www.drupal.org/project/drupal/releases/8.2.6

core/lib/Drupal/Core/Config/ConfigManager.php

@@ -297,7 +297,7 @@ class ConfigManager implements ConfigManagerInterface {
     $dependency_manager = $this->getConfigDependencyManager();
     $dependents = $this->findConfigEntityDependentsAsEntities($type, $names, $dependency_manager);
     $original_dependencies = $dependents;
-    $delete_uuids = $update_uuids = [];
+    $delete_uuids = [];
 
     $return = [
       'update' => [],
@@ -305,6 +305,13 @@ class ConfigManager implements ConfigManagerInterface {
       'unchanged' => [],
     ];
 
+    // Create a map of UUIDs to $original_dependencies key so that we can remove
+    // fixed dependencies.
+    $uuid_map = [];
+    foreach ($original_dependencies as $key => $entity) {
+      $uuid_map[$entity->uuid()] = $key;
+    }
+
     // Try to fix any dependencies and find out what will happen to the
     // dependency graph. Entities are processed in the order of most dependent
     // first. For example, this ensures that Menu UI third party dependencies on
@@ -340,8 +347,9 @@ class ConfigManager implements ConfigManagerInterface {
           }
         }
         if ($fixed) {
+          // Remove the fixed dependency from the list of original dependencies.
+          unset($original_dependencies[$uuid_map[$dependent->uuid()]]);
           $return['update'][] = $dependent;
-          $update_uuids[] = $dependent->uuid();
         }
       }
       // If the entity cannot be fixed then it has to be deleted.
@@ -354,8 +362,8 @@ class ConfigManager implements ConfigManagerInterface {
     }
     // Use the lists of UUIDs to filter the original list to work out which
     // configuration entities are unchanged.
-    $return['unchanged'] = array_filter($original_dependencies, function ($dependent) use ($delete_uuids, $update_uuids) {
-      return !(in_array($dependent->uuid(), $delete_uuids) || in_array($dependent->uuid(), $update_uuids));
+    $return['unchanged'] = array_filter($original_dependencies, function ($dependent) use ($delete_uuids) {
+      return !(in_array($dependent->uuid(), $delete_uuids));
     });
 
     return $return;

core/lib/Drupal/Core/DrupalKernel.php

@@ -1031,8 +1031,17 @@ class DrupalKernel implements DrupalKernelInterface, TerminableInterface {
       $prefix = Settings::getApcuPrefix('class_loader', $this->root);
       $apc_loader = new ApcClassLoader($prefix, $this->classLoader);
       $this->classLoader->unregister();
-      $apc_loader->register();
+      // The optimized classloader might be persistent and store cache misses.
+      // For example, once a cache miss is stored in APCu clearing it on a
+      // specific web-head will not clear any other web-heads. Therefore
+      // fallback to the composer class loader that only statically caches
+      // misses.
+      $old_loader = $this->classLoader;
       $this->classLoader = $apc_loader;
+      // Our class loaders are preprended to ensure they come first like the
+      // class loader they are replacing.
+      $old_loader->register(TRUE);
+      $apc_loader->register(TRUE);
     }
   }
 

core/lib/Drupal/Core/EventSubscriber/RssResponseRelativeUrlFilter.php

@@ -44,7 +44,16 @@ class RssResponseRelativeUrlFilter implements EventSubscriberInterface {
    */
   protected function transformRootRelativeUrlsToAbsolute($rss_markup, Request $request) {
     $rss_dom = new \DOMDocument();
+
+    // Load the RSS, if there are parsing errors, abort and return the unchanged
+    // markup.
+    $previous_value = libxml_use_internal_errors(TRUE);
     $rss_dom->loadXML($rss_markup);
+    $errors = libxml_get_errors();
+    libxml_use_internal_errors($previous_value);
+    if ($errors) {
+      return $rss_markup;
+    }
 
     // Invoke Html::transformRootRelativeUrlsToAbsolute() on all HTML content
     // embedded in this RSS feed.

core/lib/Drupal/Core/Field/FieldConfigStorageBase.php

@@ -21,8 +21,12 @@ abstract class FieldConfigStorageBase extends ConfigEntityStorage {
    * {@inheritdoc}
    */
   protected function mapFromStorageRecords(array $records) {
-    foreach ($records as &$record) {
+    foreach ($records as $id => &$record) {
       $class = $this->fieldTypeManager->getPluginClass($record['field_type']);
+      if (empty($class)) {
+        $config_id = $this->getPrefix() . $id;
+        throw new \RuntimeException("Unable to determine class for field type '{$record['field_type']}' found in the '$config_id' configuration");
+      }
       $record['settings'] = $class::fieldSettingsFromConfigData($record['settings']);
     }
     return parent::mapFromStorageRecords($records);

core/lib/Drupal/Core/File/file.api.php

@@ -26,7 +26,7 @@
  *   file is not controlled by the current module, the return value should be
  *   NULL.
  *
- * @see file_download()
+ * @see \Drupal\system\FileDownloadController::download()
  */
 function hook_file_download($uri) {
   // Check to see if this is a config download.

core/lib/Drupal/Core/Link.php

@@ -52,21 +52,8 @@ class Link implements RenderableInterface {
    * @param array $route_parameters
    *   (optional) An associative array of parameter names and values.
    * @param array $options
-   *   (optional) An associative array of additional options, with the following
-   *   elements:
-   *   - 'query': An array of query key/value-pairs (without any URL-encoding)
-   *     to append to the URL. Merged with the parameters array.
-   *   - 'fragment': A fragment identifier (named anchor) to append to the URL.
-   *     Do not include the leading '#' character.
-   *   - 'absolute': Defaults to FALSE. Whether to force the output to be an
-   *     absolute link (beginning with http:). Useful for links that will be
-   *     displayed outside the site, such as in an RSS feed.
-   *   - 'language': An optional language object used to look up the alias
-   *     for the URL. If $options['language'] is omitted, it defaults to the
-   *     current language for the language type LanguageInterface::TYPE_URL.
-   *   - 'https': Whether this URL should point to a secure location. If not
-   *     defined, the current scheme is used, so the user stays on HTTP or HTTPS
-   *     respectively. TRUE enforces HTTPS and FALSE enforces HTTP.
+   *   The options parameter takes exactly the same structure.
+   *   See \Drupal\Core\Url::fromUri() for details.
    *
    * @return static
    */

core/lib/Drupal/Core/StringTranslation/PluralTranslatableMarkup.php

@@ -157,4 +157,11 @@ class PluralTranslatableMarkup extends TranslatableMarkup {
     return -1;
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public function __sleep() {
+    return array_merge(parent::__sleep(), array('count'));
+  }
+
 }