Drupal Release Notes

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

All changes since 11.4.5

• fix: #3610122 Field data for multiple cardinality fields are not populated on entity load
• fix: #3389715 Diffs with different line endings leads to Invalid $mode 3 specified
• fix: #3610005 Styling not applied to Umami search form
• fix: #3619688 Button misaligned in exposed filters within Admin theme
• fix: #3618127 Navigation top bar action buttons in dark mode have low color contrast
• fix: #3580733 Views status field triggers a PHP 8.5 deprecation on /admin/people
• fix: #3619253 Admin theme's CSS variable selector incorrectly uses .root instead of :root
• fix: #3469280 Handle NULL mime types in template_preprocess_file_link()
• fix: #3607797 Potential XSS in block.admin.js
• task: #3615396 Update PHP_CodeSniffer to 3.13.6
• task: #3606571 Round 2 of consolidating CSS Variables
• fix: #3610934 Fatal error on edit forms of entities without bundle configuration entity (but a bundle key)
• fix: #3587995 Default admin theme settings form color pickers missing accessible names
• fix: #3611594 [regression] Recursion detected when merging duplicate #attached page_top/page_bottom attachments on node preview
• fix: #3608172 [Regression] Claro table cells should have min-height

Back to dev.

Release type:
Bug fixes

Original source

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 10.6.x will receive security support until December 2026.

Drupal 10.5.x security support has ended. Sites on any Drupal version prior to 10.6.x should upgrade to a supported release as soon as possible.

All changes since 10.6.15

• fix: #3380334 user_update_10000 fails on role with no data
• fix: #3575821 locale.check_translation route is not protected against CSRF
• fix: #3605792 SQL injection via unvalidated operator in case-insensitive entity query array conditions
• fix: #3607797 Potential XSS in block.admin.js
• task: #3615396 Update PHP_CodeSniffer to 3.13.6
• fix: #3608172 Claro table cells should have minimum height

Back to dev.

Release type:

Bug fixes

Original source

Important update information

This is an alpha release for the next major version of Drupal. This alpha release is intended for module or theme authors to begin testing whether their code is compatible with significant dependency changes in Drupal 12.0.x. Drupal 12 alpha releases should not be used in production. No upgrade path will be provided between Drupal 12 alpha releases or to Drupal 12.0.0-beta1.

Modules and themes may be moved to contrib for 12.0.0-beta1

The Search and Toolbar modules and the Claro and Olivero themes are proposed for removal in Drupal 12, but have not been removed in alpha1.

HTMX will be upgraded to version 4 for 12.0.0-beta1

HTMX is currently on v2, but v4 was recently released and will be included in Drupal 12.

Most other breaking changes have already been committed to Drupal 12.

For more information on 12.0.x development, see [12.x] [meta] Release Drupal 12 in 2026.

12.0.x will be nearly identical to 11.5.x except for the following:

• Deprecated code will be removed, including entire deprecated modules.
• Dependencies will be updated to new major versions as appropriate.
• System requirements are updated.

For all other changes, refer to the 11.5.x branch.

Sites should update to the latest release of 11.4 or 11.5 prior to updating to Drupal 12

Drupal sites running 11.3.x or earlier versions must first update to 11.4.0 or later prior to updating to Drupal 12, because all core updates added prior to 11.4.0 have been removed. In general, sites should update to the most recent release of their current major branch before updating to the next major release and we very strongly recommend updating to 11.5.0 or higher before updating to Drupal 12.

Platform requirements changes

PHP requirements

Drupal 12 requires PHP 8.5.

The default password hashing algorithm was switched to argon2id in Drupal 12. For the rare case where this is not desirable - or argon2 is not available - it can be switched to the PHP default algorithm (bcrypt) using kernel parameters.

Database requirements

The requirements for the database drivers supported by Drupal 12 are:

• The MySQL database driver requires MySQL 8.0.
• The MariaDB database driver requires MariaDB 10.11.
• The PostgreSQL database driver requires PostgreSQL 19.
• The SQLite database driver requires SQLite 3.45 with the json1 extension.

Web server

See the web server support policy for more information.

Browser support changes

See the browser support policy for more information.

Windows production environment

Support for hosting Drupal directly on Windows in production environments is deprecated. Windows is not a well supported environment, we do not have an automated Windows test environment and there are few developers who can test on Windows. Therefore, sites wanting to use Windows servers in production should plan to use Linux on Windows.

Support for Windows in development environments will continue.

The database upgrade path from releases prior to 11.4.0 has been removed

Database updates added prior to Drupal 11.4.0 have been removed from Drupal 12.0.x. To update to Drupal 12 sites must update to Drupal 11.4 or higher. We recommend updating to the most recent core 11.x release, as well as updating all of your contributed modules to their latest releases, prior to updating to Drupal 12.

Migrate Drupal and Migrate Drupal UI have been removed from core and not moved to a contributed project

Sites can continue to migrate from Drupal 6 or Drupal 7 to Drupal 11, and then update from Drupal 11 to Drupal 12 using the usual update process. Drupal 6 reached end of life in February 2016 and Drupal 7 reached end of life on January 2025.

The Migrate API remains in core.

Changes to site-owner-managed files

The robots.txt file now blocks search result pages with query parameters from being crawled by search engines. This caused search engines to index dynamically generated search results and crawl infinite combinations of faceted search pages, degrading site performance and SEO quality.

Site owners who have customized their robots.txt file should add the following rules to their robots.txt file.

Disallow: /search?
Disallow: /index.php/search?

Multiple core extensions have been removed from core and moved to contributed projects

Numerous modules and themes have been removed from Drupal core and moved to contributed projects. In many cases, the removed extensions have little to no impact on site development.

Sites should check their installed modules against the following list, and either uninstall the extension or require the contributed version prior to upgrading to Drupal 12. If a removed extension is required for a site's functionality, the contributed version should be added to the Composer requirements prior to upgrading. Do not uninstall the extension, since this would destroy the extension configuration.

Drush may bypass warning and error messages on update.php related to missing extensions. The status report will display errors about missing extensions after upgrading.

• Ban
• Contact
• Field Layout
• History
• Settings Tray
• Shortcut
• Telephone
• Stable 9

Dependency updates

• Symfony is updated to 8.1.
• Guzzle is updated to 8.0.
• PHPUnit is updated to 12.5.

Support is removed for some older dependency versions:

• doctrine/lexer: 2
• egulias/email-validator: 3
• guzzlehttp/guzzle: 7
• guzzlehttp/psr7: 2
• justinrainbow/json-schema: 5
• micheh/phpcs-gitlab: 1
• sebastian/diff: 4, 5, and 6

More backend and frontend dependency changes may be made prior to beta1.

All changes in 12.0.0-alpha1

Browse the commit log for 12.0.x.

Release type:

• Bug fixes
• New features

Original source

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 10.6.x will receive security support until December 2026.

Drupal 10.5.x security support has ended. Sites on any Drupal version prior to 10.6.x should upgrade to a supported release as soon as possible.

All changes since 10.6.14

• task: #3614340 Update to Twig 3.28
• task: #3612448 Widen constraints in core-recommended for 11.3.x and 10.6.x
• task: #3579778 Removed modules should be included as a replace in composer.json
• Revert "task: #3579778 Removed modules should be included as a replace in composer.json"
• task: #3579778 Removed modules should be included as a replace in composer.json
• fix: #3593390 Media Preview Endpoint Leaks Labels Of Non-Viewable Media By UUID

Release type

Bug fixes

Original source

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

All changes since 11.4.4

task: #3614814 Promote pdureau from provisional to full front end framework manager
fix: #3603762 HTML injection in ajax_page_state GET parameter
fix: #3593346 Entity query __toString() does not invoke the query alter hooks
fix: #3612540 [regression] Fix Toolbar with Default Admin
fix: #3614837 add SQLi protections to deprecated pgsql entity query condition class (11.x only)
task: #3614340 Update to Twig 3.28
fix: #3611989 Workspace purge deletes entities that went live through another workspace
fix: #3600904 Shipped configuration entities that do not have translatable elements are not set to the site default langcode
task: #3593472 Insecure Direct Object Reference in Private File Uploads
fix: #3600777 Redirects can be used to bypass AJAX trusted URLs
fix: #3595497 Collapsed Details Element causes JS Error for required textarea and select fields
fix: #3209204 Adding existing translation throws "Invalid translation language specified"
fix: #3612945 [random failure] SymfonyMailerTest
fix: #3613160 PHP 8.6 failure in FileStorageTest
fix: #3612163 When installing themes on the Appearance page, batches added (eg. by locale) are never executed
fix: #3613047 RouteProvider::__construct() BC branch assigns $table to $languageManager, causing fatal error on getCurrentLanguage()
task: #3579778 Removed modules should be included as a replace in composer.json
revert: #3591220 Remove DependencyFormTest.php committed to wrong issue.

Revert "task: #3579778 Removed modules should be included as a replace in composer.json"

fix: #3609119 links class missing from language switcher
task: #3591220 Convert functional tests in taxonomy module to kernel tests
task: #3578044 Clean up package manager
task: #3579778 Removed modules should be included as a replace in composer.json
fix: #3569316 Client connection () must be of type object, null given when deleting a node
fix: #3610474 MigrateSourceTestBase has a typo about #[CoversClass]
task: #3588332 file_tokens() fails when [file:owner] resolves on a file whose owner has been deleted

Revert "fix: #3569316 Client connection () must be of type object, null given when deleting a node"

fix: #3569316 Client connection () must be of type object, null given when deleting a node
fix: #3607061 Don't spellcheck composer.json
fix: #3608733 Ajax error when creating a new content view
fix: #3607061 Don't spellcheck composer.json
fix: #3593466 View mode form crashes if there are no bundles
fix: #3611054 Stable9 lifecycle link is broken
fix: #3611653 Upsert fails after upgrade from 11.3 to 11.4
fix: #3611529 Moderation state field definitions can have an incorrect target bundle
test: #3609757 Composer bin-dir setting is ignored
fix: #3029122 Drupal returns a 500 Internal error when 'destination' url query value is numeric and less than 6 length
fix: #3611084 DrupalApplication should use the compiled container
fix: #2863785 Avoid PHP notice when comparing config without uuid

Merged 11.4.4.

Back to dev.

Release type:
Bug fixes

Original source

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about the latest version of Drupal.

This update solves Composer security errors from third party components when installing drupal/core-recommended.

Drupal 10.6.x will receive security support until December 2026. Drupal 10.5.x will continue to receive security support until June 2026.

All changes since 10.6.13

• task: #3612247 Update guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to 2.12.3
• task: #3390193 Add a drupalGet() method to KernelTestBase
• fix: #3608805 [random test failure] Drupal\Tests\config\Functional\ConfigInstallProfileOverrideTest::testInstallProfileConfigOverwrite
• task: #3593098 Update CKEditor5 to 47.6.2

Back to dev.

Release type:

Bug fixes

Original source

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

This update solves Composer security errors from third party components when installing drupal/core-recommended.

Drupal 11.3.x will receive security coverage until December 2026.

All changes since 11.3.14

task: #3612247 Update guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to 2.12.3

Merged 11.3.14.

task: #3608308 Composer 2.10 causing Drupal recipe unpacking tests to fail

Back to dev.

Release type:

Bug fixes

Original source

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

No other fixes are included.

Which release do I choose? Security coverage information

Sites on Drupal 10.6.x or below should update immediately to Drupal 10.6.13. Drupal 10.6.x will receive security coverage until Drupal 10 is end-of-life in December 2026.

Sites on Drupal 11.4.x should update immediately to Drupal 11.4.4.

Sites on Drupal 11.3.x or below should update immediately to Drupal 11.3.14.

Drupal 11.2.x and below as well as Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Release type

Security update

Original source

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

No other fixes are included.

Which release do I choose? Security coverage information

Sites on Drupal 11.3.x should update immediately to Drupal 11.3.14. Drupal 11.3.x will receive security coverage until December 2026 when Drupal 11.5.0 is released.

Sites on Drupal 11.4.x should update immediately to Drupal 11.4.4.

Sites on Drupal 10.6.x or below should update immediately to Drupal 10.6.13.

Drupal 11.2.x and below as well as Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Release type:

Security update

Original source

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

No other fixes are included.

Which release do I choose? Security coverage information

Sites on Drupal 11.4.x should update immediately to Drupal 11.4.4. Drupal 11.4.x will receive security coverage until June 2027 when Drupal 11.6.0 is released.

Sites on Drupal 11.3.x should update immediately to Drupal 11.3.14.

Sites on Drupal 10.6.x should update immediately to Drupal 10.6.13.

Drupal 11.2.x and below as well as Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Release type:

Security update

Original source

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

All changes since 11.4.2

• fix: #3603333 Errors when stream wrappers instantiate services in constructors because register() is called before container is built
• fix: #3152267 Invalid use of array union operator
• fix: #3608776 [regression] Route discovery isn't fully compatible with Symfony routes
• fix: #3592946 ComponentNegotiator::negotiate() re-runs on every call when no replacement is found
• fix: #3575821 locale.check_translation route is not protected against CSRF
• fix: #3593233 Cloning an aggregate entity query shares its aggregate conditions with the original
• fix: #3590350 WorkspacePublisher doesn't roll back when a PHP Error is thrown during publishing
• fix: #3593939 AttributeRouteDiscovery: invokable controllers with class-only #[Route] never register routes due to wrong condition

Release type

Bug fixes

Original source

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

This release fixes two regressions in the update path from 11.3.x or 10.6.x to 11.4.x.

When running composer update, Drupal's scaffolding command would fail to create the newly required autoload_runtime.php in some cases, requiring running composer install in addition. This issue should now be resolved.

Sites with search and/or help modules installed would in some cases run into a fatal error during updates to enable the new search_node and search_help modules, these updates should now run smoothly.

Known issues

11.4.0 introduced an unintentional incompatibility with certain route definitions, this is being worked on in #3608776: Regression: Route discovery isn't fully compatible with Symfony routes

Several other other bugfixes and compatibility improvements are also included, see the full list below.

All changes since 11.4.1

• refactor: #3608912 Move search updates back to search module and fix missing plugin errors
• fix: #3608288 Update FileReferenceResolver::__construct() to use the more generic CacheBackendInterface
• fix: #3605792 SQL injection via unvalidated operator in case-insensitive entity query array conditions
• fix: #3608805 [random test failure] Drupal\Tests\config\Functional\ConfigInstallProfileOverrideTest::testInstallProfileConfigOverwrite
• fix: #3091285 Composer scaffolding fails when permissions on default.settings.yml or default.settings.php is not writable.
• fix: #3607866 Scaffold plugin does not always create autoload_runtime.php when upgrading to 11.4
• fix: #3609363 Regression: install_import_translations() no longer lets contrib/custom translations override core on install-from-config
• fix: #3609124 Add proper BC for ImageFormatter
• fix: #3132725 "Limit list to selected items" on exposed filters does not filter
• fix: #3609087 \Drupal\locale\LocaleProjectRepository::buildProjects() does not respect weight in 11.4.x
• task: #3608738 Avoid adding user:0 cache tag in UserRoles cache context
• fix: #3609020 BC layer in locale_translation_get_projects() implemented incorrectly
• fix: #3605554 Translations are never loaded or downloaded for a custom profile
• fix: #3608374 Data for non-revisionable/non-translatable/no-dedicated-field-tables entity types such as file is loaded twice
• fix: #3593838 Views QueryParameter argument_default plugin doesn't apply default value if root-level parameter key is present, but nested key is missing
• task: #3608308 Composer 2.10 causing Drupal recipe unpacking tests to fail

Release type:

Bug fixes

Original source

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites.

Learn more about the latest version of Drupal.
Drupal 11.4.x will receive security coverage until June 2027.
This release fixes three regressions discovered in 11.4.0 relative to 11.3.x.

Known issues

composer update may fail to successfully re-run Drupal's scaffolding command. If this fails, checking file permissions and re-running composer update or composer install may help. This issue is being worked on in #3091285: Composer scaffolding fails when permissions on default.settings.yml or default.settings.php is not writable.

Some sites with search module enabled may experience issues with updates to enable the new search_node and search_help modules. Uninstalling search module prior to updating then re-enabling the module after update (along with search_node and/or search_help) should allow other updates to complete successfully. This is being worked on in #3608912: Move search updates back to search module and fix missing plugin errors.

All changes since 11.4.0

• fix: #3607938 Chunking of Op in loadFromDedicatedTables causes Cartesian multiplication
• fix: #3608069 Restore (but don't apply) deprecated recipes to 11.4.x
• fix: #3600697 Attribute route discovery does not handle arrays for JSON:API contrib modules

Release type:

Bug fixes

Original source

This is a a feature minor release of Drupal 11 and is ready for use on production sites. Learn more about Drupal 11 and the Drupal core release cycle.

Read the Drupal 11.4.0 release announcement for improvements and highlights in this release.

This minor release provides improvements and new functionality. It does not break backward compatibility (BC) for public APIs. There may be changes in internal APIs and experimental modules. If so, contributed and custom modules and themes may need updating. This is according to Drupal core's backward compatibility and experimental module policies.

This release may include string changes and additions. Translators can review the latest translation status on localize.drupal.org.

Drupal 11.4.x contains new features, and should be the target for new site development. Drupal 11.4.x will receive security support until June 2027.

Drupal 11.3.x will continue to receive security support until December 2026.

Drupal 11 will be supported until the release of Drupal 13.

Important update information

Upgrading from Drupal 6 and 7

Drupal 6 and 7 users can continue to migrate to Drupal 11. The migration paths from Drupal 6 and Drupal 7 to Drupal 11 will remain supported throughout Drupal 11's release cycle.

The Article and Page content types have been removed from the Standard install profile and recipe. New sites using the Standard profile or recipe must configure the content type needed.

Changes to site-owner-managed files

The robots.txt file now blocks search result pages with query parameters from being crawled by search engines. This caused search engines to index dynamically generated search results and crawl infinite combinations of faceted search pages, degrading site performance and SEO quality.

Site owners who have customized their robots.txt file should add the following rules to their robots.txt file.

Disallow: /search?

Disallow: /index.php/search?

API and behavior changes

The performance of the Drupal recipe system is improved by installing extensions in batches. Developers should use RecipeRunner::installModules(), which leverages this multi-module processing.

Drupal now generates Brotli-compressed versions of aggregated CSS and JS assets when the brotli PHP extension is installed.

A new "view unpublished block content" permission allows editors to view unpublished blocks. The "administer block content" or "access block library" permissions may no longer be needed for certain editor roles.

The Symfony Runtime component has been adopted in order to simplify the Drupal bootstrap process. Sites with custom front controller scripts should read the change record to see how they need to update their code. Existing front controllers will continue to work until at least Drupal 12.

The drupal/legacy-project template included in Drupal core is now marked abandoned. Use drupal/recommended-project instead.

Deprecated extensions

The following core modules are deprecated and will be moved to contributed projects.

Contact

Field Layout

History

Migrate Drupal

Migrate Drupal UI

Telephone

The following core theme is deprecated and will be moved to a contributed project.

Stable 9

Sites will receive warning messages when deprecated extensions are in use. Review the deprecated extension documentation on the steps to take if your site uses any of these modules.

Additional modules may be deprecated prior to Drupal 12.

PHP dependency changes

The drupal/core-recommended metapackage, which restricts versions of Drupal's upstream dependencies to versions those that have been fully tested, will no longer pin versions of Guzzle, Twig, or Symfony polyfills, so that security and other updates can be applied to sites without requiring a new Drupal core release.

The twig/html-extra package, which exposes the html_cva, html_attr, and html_classes functions has been added. All three are now available for use in Twig templates

Many dependencies have received minor- and patch-level updates to the latest versions.

Frontend (CSS and JavaScript) production dependency changes

CKEditor is updated to CKEditor 5 47.6.2.

Many dependencies have received minor- and patch-level updates to the latest versions.

Known issues

Search the issue queue for known issues.

All changes since Drupal 11.4.0-rc2

task: #3606377 Update eslint and stylelint to latest minors

fix: #3387100 Missing config schema for core.base_field_override...* third_party_settings.content_translation

task: #3606390 Update JavaScript dependencies but not linting

task: #3600644 Pull up attributes from block plugins if the render array has no type or theme on the top level

build: #3600889 Remove some minor constraints from core-recommended

fix: #3606969 Content translation column group settings only show up once there are base field overrides saved

task: #3606709 Remove superflous property from update MailHandler

fix: #3072557 Plugin ID menu_link_content was not found in _menu_link_content_update_path_alias() when does not yet exist

task: #3592037 Settings::get() should not trigger a deprecation for settings with no replacement when the setting is not configured

task: #3599680 Consolidate, merge, and refactor Gin's CSS variable's into Admin theme's original variables.

revert: #3605262 Database write optimizations result in inconsistent data in data and revision tables

fix: #3591520 Fix format of some deprecation messages

task: #3581427 Add return types to BasicAuthResourceTestTrait

fix: #3552669 Error when fetching all query results as class instances

task: #3586760 Use composite key Upsert queries in core

Revert "chore: #3581427 Add return types to BasicAuthResourceTestTrait"

chore: #3581427 Add return types to BasicAuthResourceTestTrait

task: #3603733 Update guzzlehttp/psr7 to 2.12.1 and guzzlehttp/guzzle to 7.12.1

task: #3514748 (11.x revert) Remove legacy browser support from js.module.css

fix: #3585723 #date_year_range does not support years < 1000

task: #3590536 Add a MAINTAINERS.txt entry for Drupal CLI with Moshe and dww as co-maintainers

task: #3594426 Use local variable over object in \Drupal\Core\Entity\Sql\SqlContentEntityStorage::loadFromDedicatedTables() for column names

fix: #3597406 [regression] DrupalApplication (for 'dr') needs to support DRUPAL_DEV_SITE_PATH env var

fix: #3601433 Fix local_status deprecation by clearing source in a post update

fix: #3599189 Some deprecation messages are missing E_USER_DEPRECATED

Back to dev.

Merged 11.4.0-rc2.

Merged 11.4.0-rc2.

Release type:

Bug fixes

New features

Original source

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about the latest version of Drupal.

This update solves Composer security errors from third party components when installing drupal/core-recommended.

Drupal 10.6.x will receive security support until December 2026. Drupal 10.5.x will continue to receive security support until June 2026.

All changes since 10.6.11

• task: #3603733 Update guzzlehttp/psr7 to 2.12.1 and guzzlehttp/guzzle to 7.12.1
• Merged 10.6.11.
• fix: #3599842 guzzlehttp/psr7 needs to be updated to >2.10.2 to fix 2 security issues
• Revert "fix: #3593390 Media Preview Endpoint Leaks Labels Of Non-Viewable Media By UUID"
• fix: #3593390 Media Preview Endpoint Leaks Labels Of Non-Viewable Media By UUID
• docs: #3590805 DiscoveryCachedTrait::$definitions @var docblock should be array|null to match runtime semantics
• fix: #3578398 Tabledrag styles in claro break expandable elements (Firefox)
• Back to dev.

Release type:

• Bug fixes

Original source