Thanks @xxronis for working on this. Just some small nitpicks :)

+++ b/core/...

Thanks @xxronis for working on this. Just some small nitpicks :)

1. +++ b/core/modules/user/user.api.php @@ -111,11 +111,14 @@ function hook_user_cancel_methods_alter(&$methods) { + * Can be auto-escaped if it is a string, and if it has trusted HTML content,

   The other case (trusted HTML content) can be separated from the former case with punctuation full stop. Also consider it putting it in next line.

2. +++ b/core/modules/user/user.api.php @@ -111,11 +111,14 @@ function hook_user_cancel_methods_alter(&$methods) { + * a SafeString object needs to be used.

   s/needs to be/should be

3. Coding standard - Parameter tags must be grouped together in a doc comment. See https://www.drupal.org/coding-standards/docs#param.