diff --git a/.github/rm-invalid-lowest-lock-files.php b/.github/rm-invalid-lowest-lock-files.php
index 5515238d9a..81f58ccdd4 100644
--- a/.github/rm-invalid-lowest-lock-files.php
+++ b/.github/rm-invalid-lowest-lock-files.php
@@ -1,5 +1,11 @@
 <?php
 
+error_reporting(-1);
+set_error_handler(function ($type, $message, $file, $line) {
+    if (error_reporting()) {
+        throw new \ErrorException($message, 0, $type, $file, $line);
+    }
+});
 array_shift($_SERVER['argv']);
 $dirs = $_SERVER['argv'];
 
@@ -59,6 +65,8 @@ foreach ($dirs as $dir) {
     $composerJsons[$composerJson['name']] = array($dir, $composerLock['packages'], getRelevantContent($composerJson));
 }
 
+$referencedCommits = array();
+
 foreach ($composerJsons as list($dir, $lockedPackages)) {
     foreach ($lockedPackages as $lockedJson) {
         if (0 !== strpos($version = $lockedJson['version'], 'dev-') && '-dev' !== substr($version, -4)) {
@@ -83,5 +91,59 @@ foreach ($composerJsons as list($dir, $lockedPackages)) {
             @unlink($dir.'/composer.lock');
             continue 2;
         }
+
+        $referencedCommits[$name][$lockedJson['source']['reference']][] = $dir;
+    }
+}
+
+if (!$referencedCommits || (isset($_SERVER['TRAVIS_PULL_REQUEST']) && 'false' === $_SERVER['TRAVIS_PULL_REQUEST'])) {
+    // cached commits cannot be stale for PRs
+    return;
+}
+
+@mkdir($_SERVER['HOME'].'/.cache/composer/repo/https---repo.packagist.org', 0777, true);
+
+$ch = null;
+$mh = curl_multi_init();
+$sh = curl_share_init();
+curl_share_setopt($sh, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+curl_share_setopt($sh, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+curl_share_setopt($sh, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+$chs = array();
+
+foreach ($referencedCommits as $name => $dirsByCommit) {
+    $chs[] = $ch = array(curl_init(), fopen($_SERVER['HOME'].'/.cache/composer/repo/https---repo.packagist.org/provider-'.strtr($name, '/', '$').'.json', 'wb'));
+    curl_setopt($ch[0], CURLOPT_URL, 'https://repo.packagist.org/p/'.$name.'.json');
+    curl_setopt($ch[0], CURLOPT_FILE, $ch[1]);
+    curl_setopt($ch[0], CURLOPT_SHARE, $sh);
+    curl_multi_add_handle($mh, $ch[0]);
+}
+
+do {
+    curl_multi_exec($mh, $active);
+    curl_multi_select($mh);
+} while ($active);
+
+foreach ($chs as list($ch, $fd)) {
+    curl_multi_remove_handle($mh, $ch);
+    curl_close($ch);
+    fclose($fd);
+}
+
+foreach ($referencedCommits as $name => $dirsByCommit) {
+    $repo = file_get_contents($_SERVER['HOME'].'/.cache/composer/repo/https---repo.packagist.org/provider-'.strtr($name, '/', '$').'.json');
+    $repo = json_decode($repo, true);
+
+    foreach ($repo['packages'][$name] as $version) {
+        unset($referencedCommits[$name][$version['source']['reference']]);
+    }
+}
+
+foreach ($referencedCommits as $name => $dirsByCommit) {
+    foreach ($dirsByCommit as $dirs) {
+        foreach ($dirs as $dir) {
+            echo "$dir/composer.lock references old commit for $name.\n";
+            @unlink($dir.'/composer.lock');
+        }
     }
 }
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
index 5f27479509..be33ae7aba 100644
--- a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
+++ b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -1507,7 +1507,7 @@ class FrameworkExtension extends Extension
             $container->register($busId, MessageBus::class)->addArgument(array())->addTag('messenger.bus');
 
             if ($busId === $config['default_bus']) {
-                $container->setAlias('message_bus', $busId);
+                $container->setAlias('message_bus', $busId)->setPublic(true);
                 $container->setAlias(MessageBusInterface::class, $busId);
             }
         }
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
index 526816797d..16c0947678 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
@@ -530,6 +530,7 @@ abstract class FrameworkExtensionTest extends TestCase
     {
         $container = $this->createContainerFromFile('messenger');
         $this->assertTrue($container->hasAlias('message_bus'));
+        $this->assertTrue($container->getAlias('message_bus')->isPublic());
         $this->assertFalse($container->hasDefinition('messenger.transport.amqp.factory'));
         $this->assertTrue($container->hasDefinition('messenger.transport_factory'));
         $this->assertSame(TransportFactory::class, $container->getDefinition('messenger.transport_factory')->getClass());
diff --git a/src/Symfony/Component/Security/Http/Firewall.php b/src/Symfony/Component/Security/Http/Firewall.php
index bf0e9ff8cb..df665ba088 100644
--- a/src/Symfony/Component/Security/Http/Firewall.php
+++ b/src/Symfony/Component/Security/Http/Firewall.php
@@ -56,31 +56,38 @@ class Firewall implements EventSubscriberInterface
             $listeners[2] = null;
         }
 
-        $accessListener = null;
-        $authenticationListeners = array();
+        $authenticationListeners = $listeners[0];
+        $exceptionListener = $listeners[1];
+        $logoutListener = $listeners[2];
 
-        foreach ($listeners[0] as $listener) {
-            if ($listener instanceof AccessListener) {
-                $accessListener = $listener;
-            } else {
-                $authenticationListeners[] = $listener;
-            }
-        }
-
-        if (null !== $exceptionListener = $listeners[1]) {
+        if (null !== $exceptionListener) {
             $this->exceptionListeners[$event->getRequest()] = $exceptionListener;
             $exceptionListener->register($this->dispatcher);
         }
 
-        if (null !== $logoutListener = $listeners[2]) {
-            $authenticationListeners[] = $logoutListener;
-        }
+        $authenticationListeners = function () use ($authenticationListeners, $logoutListener) {
+            $accessListener = null;
 
-        if (null !== $accessListener) {
-            $authenticationListeners[] = $accessListener;
-        }
+            foreach ($authenticationListeners as $listener) {
+                if ($listener instanceof AccessListener) {
+                    $accessListener = $listener;
 
-        $this->handleRequest($event, $authenticationListeners);
+                    continue;
+                }
+
+                yield $listener;
+            }
+
+            if (null !== $logoutListener) {
+                yield $logoutListener;
+            }
+
+            if (null !== $accessListener) {
+                yield $accessListener;
+            }
+        };
+
+        $this->handleRequest($event, $authenticationListeners());
     }
 
     public function onKernelFinishRequest(FinishRequestEvent $event)