Script loading strategies are now employed in core and bundled themes to improve performance of loading scripts with defer and async attributes. Additionally, scripts on the frontend and login screen are now constructed using script helper functions, making it possible to utilize Content Security Policy to harden against XSS vulnerabilities. This change also has back-compat implications for the obsolete use of the clean_url filter to inject defer and async attributes; plugins should now use the script loading strategies API instead. The full details follow.
