reverted: --- b/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php +++ a/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php @@ -47,8 +47,7 @@ * @see _contextual_links_to_id() */ public static function preRenderPlaceholder(array $element) { + $element['#markup'] = ' $element['#id'])) . '>'; - // @todo Consider String::format instead. - $element['#markup'] = SafeMarkup::set(' $element['#id'])) . '>'); return $element; } only in patch2: unchanged: --- a/core/modules/filter/src/Element/ProcessedText.php +++ b/core/modules/filter/src/Element/ProcessedText.php @@ -8,6 +8,7 @@ namespace Drupal\filter\Element; use Drupal\Component\Utility\NestedArray; +use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\Cache; use Drupal\Core\Render\BubbleableMetadata; use Drupal\Core\Render\Element\RenderElement; @@ -120,7 +121,7 @@ public static function preRenderText($element) { // Filtering done, store in #markup, set the updated bubbleable rendering // metadata, and set the text format's cache tag. - $element['#markup'] = $text; + $element['#markup'] = SafeMarkup::set($text); $metadata->applyTo($element); $element['#cache']['tags'] = Cache::mergeTags($element['#cache']['tags'], $format->getCacheTags());