Well, that's my #Drupal security upgrades done. Less painful than I expected. Wonder what I've missed. The only pain was because I initially deployed D8 with #git rather than #Composer, out of habit. Now I'm more comfortable with Composer I should fix this. No way I'm going to be forking core in the foreseeable future. https://groups.drupal.org/security/faq-2018-002