diff --git a/core/lib/Drupal/Core/Render/Element/PasswordReveal.php b/core/lib/Drupal/Core/Render/Element/PasswordReveal.php
deleted file mode 100644
index 5124194..0000000
--- a/core/lib/Drupal/Core/Render/Element/PasswordReveal.php
+++ /dev/null
@@ -1,55 +0,0 @@
-<?php
-
-/**
- * @file
- * Contains \Drupal\Core\Render\Element\PasswordConfirm.
- */
-
-namespace Drupal\Core\Render\Element;
-
-use Drupal\Core\Form\FormStateInterface;
-
-/**
- * Provides a form element for entering a password.
- *
- * Password form element has hidden text that may be revealed by the user.
- *
- * Usage example:
- * @code
- * $form['pass'] = array(
- *   '#type' => 'password_confirm',
- *   '#title' => t('Password'),
- *   '#size' => 25,
- * );
- * @endcode
- *
- * @see \Drupal\Core\Render\Element\Password
- *
- * @FormElement("password_reveal")
- */
-class PasswordReveal extends Password {
-
-  /**
-   * {@inheritdoc}
-   */
-  public function getInfo() {
-    $info = parent::getInfo();
-    $info['#process'][] = [static::class, 'processPasswordReveal'];
-
-    return $info;
-  }
-
-  /**
-   * Adds the attributes needed to add password strength and the reveal button.
-   */
-  public static function processPasswordReveal(&$element, FormStateInterface $form_state, &$complete_form) {
-    $element['#attached']['library'][] = 'core/drupal.revealpass';
-    $element['#attributes']['class'][] = 'password-field';
-    $element['#attributes']['class'][] = 'js-password-field';
-    $element['#attributes']['data-drupal-revealpass'] = TRUE;
-    $element['#attributes']['data-drupal-password-strength'] = TRUE;
-
-    return $element;
-  }
-
-}
diff --git a/core/misc/revealpass.js b/core/misc/revealpass.js
deleted file mode 100644
index 7d9a27c..0000000
--- a/core/misc/revealpass.js
+++ /dev/null
@@ -1,59 +0,0 @@
-/**
- * @file
- * Creates a reveal password link on password inputs.
- */
-
-(function ($, Drupal) {
-
-  'use strict';
-
-  var showPass = Drupal.t('Show password');
-  var hidePass = Drupal.t('Hide password');
-
-  /**
-   * Reveal click handle that either shows or hides the password.
-   *
-   * @param {jQuery.Event} event
-   *   The jQuery event.
-   */
-  function revealClickHandle(event) {
-    var $pass = $(event.data.password);
-    var $button = $(event.target);
-
-    if ($pass.attr('type') === 'password') {
-      $pass.attr('type', 'text');
-      $button.text(hidePass);
-    }
-    else {
-      $pass.attr('type', 'password');
-      $button.text(showPass);
-    }
-  }
-
-  /**
-   * Create reveal button and bind event.
-   *
-   * @param {number} index
-   * @param {HTMLElement} element
-   */
-  function revealLink(index, element) {
-    var $trigger = $('<button type="button" class="link toggle-password">' + showPass + '</button>');
-
-    $trigger.on('click', {password: element}, revealClickHandle);
-    $trigger.insertAfter(element);
-  }
-
-  /**
-   * Initialize reveal links.
-   *
-   * @type {Drupal~behavior}
-   */
-  Drupal.behaviors.revealPass = {
-    attach: function (context) {
-      $(context).find('input[type=password][data-drupal-revealpass]')
-        .once('revealpass')
-        .each(revealLink);
-    }
-  };
-
-})(jQuery, Drupal);
diff --git a/core/modules/user/user.js b/core/modules/user/user.js
index 7af3902..f4602c6 100644
--- a/core/modules/user/user.js
+++ b/core/modules/user/user.js
@@ -33,12 +33,12 @@
 
         // Add the password confirmation layer.
         $passwordInputParentWrapper
-          .find('input[data-drupal-password-strength]')
+          .find('input.js-password-confirm')
           .parent()
-          .append('<div aria-live="polite" aria-atomic="true" class="password-confirm js-password-field">' + translate.confirmTitle + ' <span></span></div>')
+          .append('<div aria-live="polite" aria-atomic="true" class="password-confirm js-password-confirm">' + translate.confirmTitle + ' <span></span></div>')
           .addClass('confirm-parent');
 
-        var $confirmInput = $passwordInputParentWrapper.find('input[data-drupal-password-strength]');
+        var $confirmInput = $passwordInputParentWrapper.find('input.js-password-confirm');
         var $confirmResult = $passwordInputParentWrapper.find('div.js-password-confirm');
         var $confirmChild = $confirmResult.find('span');
 
diff --git a/core/tests/Drupal/Tests/Core/Render/Element/PasswordRevealTest.php b/core/tests/Drupal/Tests/Core/Render/Element/PasswordRevealTest.php
deleted file mode 100644
index 9fbffdb..0000000
--- a/core/tests/Drupal/Tests/Core/Render/Element/PasswordRevealTest.php
+++ /dev/null
@@ -1,45 +0,0 @@
-<?php
-
-/**
- * @file
- * Contains \Drupal\Tests\Core\Render\Element\PasswordRevealTest.
- */
-
-namespace Drupal\Tests\Core\Render\Element;
-
-use Drupal\Core\Form\FormStateInterface;
-use Drupal\Core\Render\Element\PasswordReveal;
-use Drupal\Tests\UnitTestCase;
-
-/**
- * @coversDefaultClass \Drupal\Core\Render\Element\PasswordReveal
- * @group Render
- */
-class PasswordRevealTest extends UnitTestCase {
-
-  /**
-   * @covers ::valueCallback
-   *
-   * @dataProvider providerTestValueCallback
-   */
-  public function testValueCallback($expected, $input) {
-    $element = [];
-    $form_state = $this->prophesize(FormStateInterface::class)->reveal();
-    $this->assertSame($expected, PasswordReveal::valueCallback($element, $input, $form_state));
-  }
-
-  /**
-   * Data provider for testValueCallback().
-   */
-  public function providerTestValueCallback() {
-    $data = [];
-    $data[] = [NULL, FALSE];
-    $data[] = [NULL, NULL];
-    $data[] = ['', ['test']];
-    $data[] = ['test', 'test'];
-    $data[] = ['123', 123];
-
-    return $data;
-  }
-
-}
diff --git a/sites/default/default.services.yml b/sites/default/default.services.yml
index e1bbbc7..23f6483 100644
--- a/sites/default/default.services.yml
+++ b/sites/default/default.services.yml
@@ -153,22 +153,3 @@ parameters:
     - sftp
     - webcal
     - rtsp
-
-   # Configure Cross-Site HTTP requests (CORS).
-   # Read https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
-   # for more information about the topic in general.
-   # Note: By default the configuration is disabled.
-  cors.config:
-    enabled: false
-    # Specify allowed headers, like 'x-allowed-header'.
-    allowedHeaders: []
-    # Specify allowed request methods, specify ['*'] to allow all possible ones.
-    allowedMethods: []
-    # Configure requests allowed from specific origins.
-    allowedOrigins: ['*']
-    # Sets the Access-Control-Expose-Headers header.
-    exposedHeaders: false
-    # Sets the Access-Control-Max-Age header.
-    maxAge: false
-    # Sets the Access-Control-Allow-Credentials header.
-    supportsCredentials: false
diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php
index 94a1e04..d42962d 100644
--- a/sites/default/default.settings.php
+++ b/sites/default/default.settings.php
@@ -144,11 +144,6 @@
  * @code
  *   'prefix' => 'main_',
  * @endcode
- *
- * Per-table prefixes are deprecated as of Drupal 8.2, and will be removed in
- * Drupal 9.0. After that, only a single prefix for all tables will be
- * supported.
- *
  * To provide prefixes for specific tables, set 'prefix' as an array.
  * The array's keys are the table names and the values are the prefixes.
  * The 'default' element is mandatory and holds the prefix for any tables
@@ -422,20 +417,6 @@
  */
 # $settings['omit_vary_cookie'] = TRUE;
 
-
-/**
- * Cache TTL for client error (4xx) responses.
- *
- * Items cached per-URL tend to result in a large number of cache items, and
- * this can be problematic on 404 pages which by their nature are unbounded. A
- * fixed TTL can be set for these items, defaulting to one hour, so that cache
- * backends which do not support LRU can purge older entries. To disable caching
- * of client error responses set the value to 0. Currently applies only to
- * page_cache module.
- */
-# $settings['cache_ttl_4xx'] = 3600;
-
-
 /**
  * Class Loader.
  *
@@ -684,15 +665,6 @@
 # $settings['container_base_class'] = '\Drupal\Core\DependencyInjection\Container';
 
 /**
- * Override the default yaml parser class.
- *
- * Provide a fully qualified class name here if you would like to provide an
- * alternate implementation YAML parser. The class must implement the
- * \Drupal\Component\Serialization\SerializationInterface interface.
- */
-# $settings['yaml_parser_class'] = NULL;
-
-/**
  * Trusted host configuration.
  *
  * Drupal core can use the Symfony trusted host mechanism to prevent HTTP Host
@@ -730,21 +702,6 @@
  */
 
 /**
- * The default list of directories that will be ignored by Drupal's file API.
- *
- * By default ignore node_modules and bower_components folders to avoid issues
- * with common frontend tools and recursive scanning of directories looking for
- * extensions.
- *
- * @see file_scan_directory()
- * @see \Drupal\Core\Extension\ExtensionDiscovery::scanDirectory()
- */
-$settings['file_scan_ignore_directories'] = [
-  'node_modules',
-  'bower_components',
-];
-
-/**
  * Load local development override configuration, if available.
  *
  * Use settings.local.php to override variables on secondary (staging,