only in patch2:
unchanged:
--- a/core/modules/dblog/tests/src/Functional/DbLogTest.php
+++ b/core/modules/dblog/tests/src/Functional/DbLogTest.php
@@ -805,7 +805,7 @@ public function testOverviewLinks() {
     $this->drupalGet('admin/reports/dblog');
     $this->assertResponse(200);
     // Make sure HTML tags are filtered out.
-    $this->assertRaw('title="alert('foo');Lorem');
+    $this->assertRaw('title="alert('foo');Lorem');
     $this->assertNoRaw("<script>alert('foo');</script>");
 
     // Make sure HTML tags are filtered out in admin/reports/dblog/event/ too.
only in patch2:
unchanged:
--- a/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php
+++ b/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php
@@ -63,7 +63,7 @@ public function providerTestFilterXss() {
 
     // Image XSS using the JavaScript directive.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Image_XSS_using_the_JavaScript_directive
-    $data[] = ['<IMG SRC="javascript:alert(\'XSS\');">', '<IMG src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<IMG SRC="javascript:alert(\'XSS\');">', '<IMG src="alert(&apos;XSS&apos;);">'];
 
     // No quotes and no semicolon.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#No_quotes_and_no_semicolon
@@ -100,7 +100,7 @@ public function providerTestFilterXss() {
 
     // Default SRC tag by leaving it empty.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Default_SRC_tag_by_leaving_it_empty
-    $data[] = ['<IMG SRC= onmouseover="alert(\'xxs\')">', '<IMG nmouseover="alert(&#039;xxs&#039;)">'];
+    $data[] = ['<IMG SRC= onmouseover="alert(\'xxs\')">', '<IMG nmouseover="alert(&apos;xxs&apos;)">'];
 
     // Default SRC tag by leaving it out entirely.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Default_SRC_tag_by_leaving_it_out_entirely
@@ -108,7 +108,7 @@ public function providerTestFilterXss() {
 
     // Decimal HTML character references.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Decimal_HTML_character_references
-    $data[] = ['<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>', '<IMG src="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>', '<IMG src="alert(&apos;XSS&apos;)">'];
 
     // Decimal HTML character references without trailing semicolons.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Decimal_HTML_character_references_without_trailing_semicolons
@@ -120,19 +120,19 @@ public function providerTestFilterXss() {
 
     // Embedded tab.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_tab
-    $data[] = ['<IMG SRC="jav  ascript:alert(\'XSS\');">', '<IMG src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<IMG SRC="jav  ascript:alert(\'XSS\');">', '<IMG src="alert(&apos;XSS&apos;);">'];
 
     // Embedded Encoded tab.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_Encoded_tab
-    $data[] = ['<IMG SRC="jav&#x09;ascript:alert(\'XSS\');">', '<IMG src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<IMG SRC="jav&#x09;ascript:alert(\'XSS\');">', '<IMG src="alert(&apos;XSS&apos;);">'];
 
     // Embedded newline to break up XSS.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_newline_to_break_up_XSS
-    $data[] = ['<IMG SRC="jav&#x0A;ascript:alert(\'XSS\');">', '<IMG src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<IMG SRC="jav&#x0A;ascript:alert(\'XSS\');">', '<IMG src="alert(&apos;XSS&apos;);">'];
 
     // Embedded carriage return to break up XSS.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_carriage_return_to_break_up_XSS
-    $data[] = ['<IMG SRC="jav&#x0D;ascript:alert(\'XSS\');">', '<IMG src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<IMG SRC="jav&#x0D;ascript:alert(\'XSS\');">', '<IMG src="alert(&apos;XSS&apos;);">'];
 
     // Null breaks up JavaScript directive.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Null_breaks_up_JavaScript_directive
@@ -143,7 +143,7 @@ public function providerTestFilterXss() {
     // @fixme This dataset currently fails under 5.4 because of
     //   https://www.drupal.org/node/1210798. Restore after it's fixed.
     if (version_compare(PHP_VERSION, '5.4.0', '<')) {
-      $data[] = ['<IMG SRC=" &#14;  javascript:alert(\'XSS\');">', '<IMG src="alert(&#039;XSS&#039;);">'];
+      $data[] = ['<IMG SRC=" &#14;  javascript:alert(\'XSS\');">', '<IMG src="alert(&apos;XSS&apos;);">'];
     }
 
     // Non-alpha-non-digit XSS.
@@ -166,7 +166,7 @@ public function providerTestFilterXss() {
 
     // Half open HTML/JavaScript XSS vector.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Half_open_HTML.2FJavaScript_XSS_vector
-    $data[] = ['<IMG SRC="javascript:alert(\'XSS\')"', '<IMG src="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<IMG SRC="javascript:alert(\'XSS\')"', '<IMG src="alert(&apos;XSS&apos;)">'];
 
     // Double open angle brackets.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Double_open_angle_brackets
@@ -185,19 +185,19 @@ public function providerTestFilterXss() {
 
     // INPUT image.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#INPUT_image
-    $data[] = ['<INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');">', '<INPUT type="IMAGE" src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');">', '<INPUT type="IMAGE" src="alert(&apos;XSS&apos;);">'];
 
     // BODY image.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BODY_image
-    $data[] = ['<BODY BACKGROUND="javascript:alert(\'XSS\')">', '<BODY background="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<BODY BACKGROUND="javascript:alert(\'XSS\')">', '<BODY background="alert(&apos;XSS&apos;)">'];
 
     // IMG Dynsrc.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IMG_Dynsrc
-    $data[] = ['<IMG DYNSRC="javascript:alert(\'XSS\')">', '<IMG dynsrc="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<IMG DYNSRC="javascript:alert(\'XSS\')">', '<IMG dynsrc="alert(&apos;XSS&apos;)">'];
 
     // IMG lowsrc.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IMG_lowsrc
-    $data[] = ['<IMG LOWSRC="javascript:alert(\'XSS\')">', '<IMG lowsrc="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<IMG LOWSRC="javascript:alert(\'XSS\')">', '<IMG lowsrc="alert(&apos;XSS&apos;)">'];
 
     // List-style-image.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#List-style-image
@@ -328,7 +328,7 @@ public function providerTestFilterXss() {
 
     // BGSOUND.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BGSOUND
-    $data[] = ['<BGSOUND SRC="javascript:alert(\'XSS\');">', '<BGSOUND src="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<BGSOUND SRC="javascript:alert(\'XSS\');">', '<BGSOUND src="alert(&apos;XSS&apos;);">'];
 
     // & JavaScript includes.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#.26_JavaScript_includes
@@ -393,7 +393,7 @@ public function providerTestFilterXss() {
 
     // META.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META
-    $data[] = ['<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');">', '<META http-equiv="refresh" content="alert(&#039;XSS&#039;);">'];
+    $data[] = ['<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');">', '<META http-equiv="refresh" content="alert(&apos;XSS&apos;);">'];
 
     // META using data.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META_using_data
@@ -401,11 +401,11 @@ public function providerTestFilterXss() {
 
     // META with additional URL parameter
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META
-    $data[] = ['<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');">', '<META http-equiv="refresh" content="//;URL=javascript:alert(&#039;XSS&#039;);">'];
+    $data[] = ['<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');">', '<META http-equiv="refresh" content="//;URL=javascript:alert(&apos;XSS&apos;);">'];
 
     // IFRAME.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IFRAME
-    $data[] = ['<IFRAME SRC="javascript:alert(\'XSS\');"></IFRAME>', '<IFRAME src="alert(&#039;XSS&#039;);"></IFRAME>'];
+    $data[] = ['<IFRAME SRC="javascript:alert(\'XSS\');"></IFRAME>', '<IFRAME src="alert(&apos;XSS&apos;);"></IFRAME>'];
 
     // IFRAME Event based.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IFRAME_Event_based
@@ -413,15 +413,15 @@ public function providerTestFilterXss() {
 
     // FRAME.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#FRAME
-    $data[] = ['<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>', '<FRAMESET><FRAME src="alert(&#039;XSS&#039;);"></FRAMESET>'];
+    $data[] = ['<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>', '<FRAMESET><FRAME src="alert(&apos;XSS&apos;);"></FRAMESET>'];
 
     // TABLE.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#TABLE
-    $data[] = ['<TABLE BACKGROUND="javascript:alert(\'XSS\')">', '<TABLE background="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<TABLE BACKGROUND="javascript:alert(\'XSS\')">', '<TABLE background="alert(&apos;XSS&apos;)">'];
 
     // TD.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#TD
-    $data[] = ['<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')">', '<TABLE><TD background="alert(&#039;XSS&#039;)">'];
+    $data[] = ['<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')">', '<TABLE><TD background="alert(&apos;XSS&apos;)">'];
 
     // DIV background-image.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#DIV_background-image
@@ -447,7 +447,7 @@ public function providerTestFilterXss() {
 
     // BASE tag.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BASE_tag
-    $data[] = ['<BASE HREF="javascript:alert(\'XSS\');//">', '<BASE href="alert(&#039;XSS&#039;);//">'];
+    $data[] = ['<BASE HREF="javascript:alert(\'XSS\');//">', '<BASE href="alert(&apos;XSS&apos;);//">'];
 
     // OBJECT tag.
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#OBJECT_tag
only in patch2:
unchanged:
--- a/core/modules/field_ui/src/Tests/ManageFieldsTest.php
+++ b/core/modules/field_ui/src/Tests/ManageFieldsTest.php
@@ -653,7 +653,7 @@ public function testExternalDestinations() {
     // The external redirect should not fire.
     $this->assertUrl('admin/structure/types/manage/article/fields/node.article.body/storage', $options);
     $this->assertResponse(200);
-    $this->assertRaw('Attempt to update field <em class="placeholder">Body</em> failed: <em class="placeholder">The internal path component &#039;http://example.com&#039; is external. You are not allowed to specify an external URL together with internal:/.</em>.');
+    $this->assertRaw('Attempt to update field <em class="placeholder">Body</em> failed: <em class="placeholder">The internal path component &apos;http://example.com&apos; is external. You are not allowed to specify an external URL together with internal:/.</em>.');
   }
 
   /**
only in patch2:
unchanged:
--- a/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
+++ b/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
@@ -532,7 +532,7 @@ public function testHtmlEscapeFilter() {
 
     $tests = [
       "   One. <!-- \"comment\" --> Two'.\n<p>Three.</p>\n    " => [
-        "One. &lt;!-- &quot;comment&quot; --&gt; Two&#039;.\n&lt;p&gt;Three.&lt;/p&gt;" => TRUE,
+        "One. &lt;!-- &quot;comment&quot; --&gt; Two&apos;.\n&lt;p&gt;Three.&lt;/p&gt;" => TRUE,
         '   One.' => FALSE,
         "</p>\n    " => FALSE,
       ],
only in patch2:
unchanged:
--- a/core/modules/locale/tests/src/Kernel/LocaleStringIsSafeTest.php
+++ b/core/modules/locale/tests/src/Kernel/LocaleStringIsSafeTest.php
@@ -54,11 +54,11 @@ public function testLocalizedTokenizedString() {
     $tests_to_do = [
       1 => [
         'original' => 'Go to the <a href="[locale_test:security_test1]">frontpage</a>',
-        'replaced' => 'Go to the &lt;a href=&quot;javascript:alert(&amp;#039;Mooooh!&amp;#039;);&quot;&gt;frontpage&lt;/a&gt;',
+        'replaced' => 'Go to the &lt;a href=&quot;javascript:alert(&amp;&apos;Mooooh!&amp;&apos;);&quot;&gt;frontpage&lt;/a&gt;',
       ],
       2 => [
         'original' => 'Hello <strong>[locale_test:security_test2]</strong>!',
-        'replaced' => 'Hello &lt;strong&gt;&amp;lt;script&amp;gt;alert(&amp;#039;Mooooh!&amp;#039;);&amp;lt;/script&amp;gt;&lt;/strong&gt;!',
+        'replaced' => 'Hello &lt;strong&gt;&amp;lt;script&amp;gt;alert(&amp;&apos;Mooooh!&amp;&apos;);&amp;lt;/script&amp;gt;&lt;/strong&gt;!',
       ],
     ];
 
only in patch2:
unchanged:
--- a/core/modules/search/src/Tests/SearchCommentTest.php
+++ b/core/modules/search/src/Tests/SearchCommentTest.php
@@ -172,7 +172,7 @@ public function testSearchResultsComment() {
     $this->drupalPostForm('search/node', $edit, t('Search'));
 
     // Verify the evil comment subject is escaped in search results.
-    $this->assertRaw('&lt;script&gt;alert(&#039;<strong>subjectkeyword</strong>&#039;);');
+    $this->assertRaw('&lt;script&gt;alert(&apos;<strong>subjectkeyword</strong>&apos;);');
     $this->assertNoRaw('<script>');
 
     // Search for the keyword near the evil script tag in the comment body.
only in patch2:
unchanged:
--- a/core/modules/system/src/Tests/Common/AddFeedTest.php
+++ b/core/modules/system/src/Tests/Common/AddFeedTest.php
@@ -89,7 +89,7 @@ public function testFeedIconEscaping() {
       '#title' => '<>&"\'',
     ];
     $text = \Drupal::service('renderer')->renderRoot($variables);
-    $this->assertEqual(trim(strip_tags($text)), 'Subscribe to &lt;&gt;&amp;&quot;&#039;', 'feed_icon template escapes reserved HTML characters.');
+    $this->assertEqual(trim(strip_tags($text)), 'Subscribe to &lt;&gt;&amp;&quot;&apos;', 'feed_icon template escapes reserved HTML characters.');
   }
 
 }
only in patch2:
unchanged:
--- a/core/modules/system/src/Tests/System/ErrorHandlerTest.php
+++ b/core/modules/system/src/Tests/System/ErrorHandlerTest.php
@@ -73,8 +73,8 @@ public function testErrorHandler() {
     $this->assertErrorMessage($fatal_error);
     $this->assertRaw('<pre class="backtrace">', 'Found pre element with backtrace class.');
     // Ensure we are escaping but not double escaping.
-    $this->assertRaw('&#039;');
-    $this->assertNoRaw('&amp;#039;');
+    $this->assertRaw('&apos;');
+    $this->assertNoRaw('&amp;&apos;');
 
     // Remove the recoverable fatal error from the assertions, it's wanted here.
     // Ensure that we just remove this one recoverable fatal error (in PHP 7 this
only in patch2:
unchanged:
--- a/core/modules/system/src/Tests/Theme/TwigDebugMarkupTest.php
+++ b/core/modules/system/src/Tests/Theme/TwigDebugMarkupTest.php
@@ -66,7 +66,7 @@ public function testTwigDebugMarkup() {
     $build += node_view($node3);
     $output = $renderer->renderRoot($build);
     $this->assertTrue(strpos($output, "THEME HOOK: 'node__foo__bar'") !== FALSE, 'Theme call information found.');
-    $this->assertTrue(strpos($output, '* node--foo--bar' . $extension . PHP_EOL . '   * node--foo' . $extension . PHP_EOL . '   * node--&lt;script type=&quot;text/javascript&quot;&gt;alert(&#039;yo&#039;);&lt;/script&gt;' . $extension . PHP_EOL . '   * node--3--full' . $extension . PHP_EOL . '   * node--3' . $extension . PHP_EOL . '   * node--page--full' . $extension . PHP_EOL . '   * node--page' . $extension . PHP_EOL . '   * node--full' . $extension . PHP_EOL . '   x node' . $extension) !== FALSE, 'Suggested template files found in order and base template shown as current template.');
+    $this->assertTrue(strpos($output, '* node--foo--bar' . $extension . PHP_EOL . '   * node--foo' . $extension . PHP_EOL . '   * node--&lt;script type=&quot;text/javascript&quot;&gt;alert(&apos;yo&apos;);&lt;/script&gt;' . $extension . PHP_EOL . '   * node--3--full' . $extension . PHP_EOL . '   * node--3' . $extension . PHP_EOL . '   * node--page--full' . $extension . PHP_EOL . '   * node--page' . $extension . PHP_EOL . '   * node--full' . $extension . PHP_EOL . '   x node' . $extension) !== FALSE, 'Suggested template files found in order and base template shown as current template.');
 
     // Disable debug, rebuild the service container, and clear all caches.
     $parameters = $this->container->getParameter('twig.config');
only in patch2:
unchanged:
--- a/core/modules/views_ui/src/Tests/PreviewTest.php
+++ b/core/modules/views_ui/src/Tests/PreviewTest.php
@@ -105,7 +105,7 @@ public function testPreviewUI() {
     $this->assertText(t('Query execute time'));
     $this->assertText(t('View render time'));
     $this->assertRaw('<strong>Query</strong>');
-    $this->assertText("SELECT views_test_data.name AS views_test_data_name\nFROM \n{views_test_data} views_test_data\nWHERE (views_test_data.id = &#039;100&#039; )");
+    $this->assertText("SELECT views_test_data.name AS views_test_data_name\nFROM \n{views_test_data} views_test_data\nWHERE (views_test_data.id = &apos;100&apos; )");
 
     // Test that the statistics and query are rendered above the preview.
     $this->assertTrue(strpos($this->getRawContent(), 'views-query-info') < strpos($this->getRawContent(), 'view-test-preview'), 'Statistics shown above the preview.');
only in patch2:
unchanged:
--- a/core/tests/Drupal/Tests/Component/Render/HtmlEscapedTextTest.php
+++ b/core/tests/Drupal/Tests/Component/Render/HtmlEscapedTextTest.php
@@ -43,11 +43,11 @@ public function providerToString() {
     $script_tag = $script_tag->reveal();
     $tests[] = [$script_tag, '&lt;script&gt;', 'Escapes &lt;script&gt; even inside an object that implements MarkupInterface.'];
     $tests[] = ["<script>", '&lt;script&gt;', 'Escapes &lt;script&gt;'];
-    $tests[] = ['<>&"\'', '&lt;&gt;&amp;&quot;&#039;', 'Escapes reserved HTML characters.'];
+    $tests[] = ['<>&"\'', '&lt;&gt;&amp;&quot;&apos;', 'Escapes reserved HTML characters.'];
     $specialchars = $this->prophesize(MarkupInterface::class);
     $specialchars->__toString()->willReturn('<>&"\'');
     $specialchars = $specialchars->reveal();
-    $tests[] = [$specialchars, '&lt;&gt;&amp;&quot;&#039;', 'Escapes reserved HTML characters even inside an object that implements MarkupInterface.'];
+    $tests[] = [$specialchars, '&lt;&gt;&amp;&quot;&apos;', 'Escapes reserved HTML characters even inside an object that implements MarkupInterface.'];
 
     return $tests;
   }
only in patch2:
unchanged:
--- a/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php
@@ -252,6 +252,7 @@ public function providerDecodeEntities() {
       ["'", "'"],
       ['&#39;', "'"],
       ['&amp;#39;', '&#39;'],
+      ['&apos;', "'"],
       ['©', '©'],
       ['&copy;', '©'],
       ['&#169;', '©'],
only in patch2:
unchanged:
--- a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
@@ -96,8 +96,8 @@ public function providerCheckPlain() {
     // Checks that special characters are escaped.
     $tests[] = [SafeMarkupTestMarkup::create("<script>"), '&lt;script&gt;', 'Escapes &lt;script&gt; even inside an object that implements MarkupInterface.'];
     $tests[] = ["<script>", '&lt;script&gt;', 'Escapes &lt;script&gt;'];
-    $tests[] = ['<>&"\'', '&lt;&gt;&amp;&quot;&#039;', 'Escapes reserved HTML characters.'];
-    $tests[] = [SafeMarkupTestMarkup::create('<>&"\''), '&lt;&gt;&amp;&quot;&#039;', 'Escapes reserved HTML characters even inside an object that implements MarkupInterface.'];
+    $tests[] = ['<>&"\'', '&lt;&gt;&amp;&quot;&apos;', 'Escapes reserved HTML characters.'];
+    $tests[] = [SafeMarkupTestMarkup::create('<>&"\''), '&lt;&gt;&amp;&quot;&apos;', 'Escapes reserved HTML characters even inside an object that implements MarkupInterface.'];
 
     return $tests;
   }
only in patch2:
unchanged:
--- a/core/tests/Drupal/Tests/Core/Render/RendererTest.php
+++ b/core/tests/Drupal/Tests/Core/Render/RendererTest.php
@@ -119,7 +119,7 @@ public function providerTestRenderBasic() {
     // Html escaping test.
     $data[] = [[
       'child' => ['#plain_text' => "This is <script><em>alert('XSS')</em></script> <strong>test</strong>"],
-    ], "This is &lt;script&gt;&lt;em&gt;alert(&#039;XSS&#039;)&lt;/em&gt;&lt;/script&gt; &lt;strong&gt;test&lt;/strong&gt;"];
+    ], "This is &lt;script&gt;&lt;em&gt;alert(&apos;XSS&apos;)&lt;/em&gt;&lt;/script&gt; &lt;strong&gt;test&lt;/strong&gt;"];
     // XSS filtering by default test.
     $data[] = [[
       'child' => ['#markup' => "This is <script><em>alert('XSS')</em></script> <strong>test</strong>"],
only in patch2:
unchanged:
--- a/core/tests/Drupal/Tests/Core/Template/TwigExtensionTest.php
+++ b/core/tests/Drupal/Tests/Core/Template/TwigExtensionTest.php
@@ -206,7 +206,7 @@ public function testSafeStringEscaping() {
 
     // Ensure objects that do not implement MarkupInterface are escaped.
     $string_object = new TwigExtensionTestString("<script>alert('here');</script>");
-    $this->assertSame('&lt;script&gt;alert(&#039;here&#039;);&lt;/script&gt;', $this->systemUnderTest->escapeFilter($twig, $string_object, 'html', 'UTF-8', TRUE));
+    $this->assertSame('&lt;script&gt;alert(&apos;here&apos;);&lt;/script&gt;', $this->systemUnderTest->escapeFilter($twig, $string_object, 'html', 'UTF-8', TRUE));
   }
 
   /**