Drupal full changelog

All changes since 11.3.9:
task: #3592421 Update Symfony routing and http-foundation versions
fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in generated URLs
task: #3592382 Update Twig to v3.27.0
task: #3592065 Drupal core-recommended pins vulnerable symfony/polyfill-intl-idn version affected by CVE-2026-46644
task: #3567980 Remove unneeded parameter $requestStack from EntityController
Merged 11.3.10.
fix: #3588331 PsrResponseSubscriber doesn't support PsrHttpMessageStreamInterface
fix: #3301239 Improve the error message thrown in PoStreamReader::readLine() when translations cannot be saved
Revert "fix: #2844620 Automatically split cache debug headers into multiple lines when they exceed 8k"
fix: #2844620 Automatically split cache debug headers into multiple lines when they exceed 8k
docs: #3589633 Remove realityloop from MAINTAINERS.txt
fix: #3559132 FileSystem::deleteRecursive() leaves files/directories when realpath() returns FALSE
fix: follow-up #3463868 Two #config_targets error when used on a text_format form element
fix: #3463868 Two #config_targets error when used on a text_format form element
fix: #3586099 SystemAdminThemePreprocess::preprocessSystemModulesDetails() shows @theme instead of the theme name that depends on a module
task: #3588897 Widen the script/stylesheet bytes assertion ranges in performance tests

Fix: #3584812 ConfigInstaller isSyncing does not persist to hook_modules_installed() when multiple modules are installed
Fix: #3582171 [PHP 8.5] Strengthen views data with entity types w/o data tables
Revert "fix: #3582171 [PHP 8.5] Strengthen views data with entity types w/o data tables"
Fix: #3582514 Add SensitiveParameter attribute to Crypt::hmacBase64()
Fix: #3526541 Cannot set default values on multi-valued formatted Text fields
Fix: #3582229 Package Manager blows up when it encounters already-unpacked recipes

Security issues fixed:
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

All changes since 11.3.5:
fix: #3571849 Media Library allows user to select more media than expected
fix: #3582171 [PHP 8.5] Strengthen views data with entity types w/o data tables
Revert "docs: #3576253 Improve navigation module description"
docs: #3576253 Improve navigation module description
test: #3579629 Add procedural hooks to test theme to test collection and invoking legacy hooks
task: #3582512 Add SensitiveParameter attribute to CsrfTokenGenerator::validate()
fix: #3576262 [random test failure] MediaSourceFileTest::testMediaFileSource
fix: #3582125 Improve the deprecation message in getMigrationDependencies()
chore: #3567589 Exempt 'system.modules_uninstall' route in UpdateHooks::pageTop()
task: #3582584 Add Andrei Mateescu as provisional general core committer
ci: #3581997 PHPStan is failing on 11.3.x
fix: #3565033 Fix using numeric literals for 'version' in .info.yml files, cast to strings
docs: #3576233 Correct documentation for ::getChangedTimeAcrossTranslations()
chore: #3581530 Update google/protobuf to >= 4.33.6
fix: #3578193 CommentTokensHooks passes NULL to UrlHelper::stripDangerousProtocols() when comment homepage is not set
feat: #3086655 Add composer instructions to INSTALL.txt
fix: #3569172 Weird language negotiation behavior inside getLanguageSwitchLinks leading to incorrect languages being used
fix: #3575096 Remove callable type from BatchBuilder ::addOperation and ::setFinishCallback
fix: #3560719 Add [#NoDiscard] to AccessResult methods or make them chainable
fix: #3577001 LocaleConfigManager::updateConfigTranslations() unconditionally re-saves unchanged config overrides
task: #3566051 Add darvanen as a maintainer of the Menu UI subsystem
task: #3566048 Add darvanen as a maintainer of the Token subsystem
fix: #3572039 Add dropdown list relies on buttons being input elements
fix: #3572679 Prevent undefined array key warnings in AddToAllBundles
fix: #3570209 ContentEntityStorageBase::setPersistentRevisionCache() merges cache tags

This is a patch (bugfix) release of Drupal 11

All changes since 11.3.3:
Task: #3576995 Update CKEditor 5 to 47.6.0
Fix: #3572047 "Last" pager links inside a modal do not open in the modal
Fix: #3319212 Entities without labels cause TypeError in EntityController title callbacks
Fix: #3576074 Current user is changed unexpectedly (follow-up)
Fix: #3576074 Current user is changed unexpectedly
Fix: #3573953 LogicException in Renderer::render() still mentions renderPlain()
Fix: #3525391 Conditions plugin validation schema is wrong
Fix: #3439643 Improve how and what navigation block titles are communicating to screenreader users
Fix: #3558934 Fix styling of link autocomplete with long titles
Fix: #3560659 HTMX Drupal behaviors are not applied when swapped element is body
Fix: #3564735 Container / service exceptions while installed from existing config
Fix: #3575066 Olivero mobile close button not properly placed against top nav bar
Fix: #3562072 Menu link content export with dependencies doesn't include parent menu link entity.
Task: #3572169 Put the mobile sidebar close button into the TAB sequence
Fix: #3565020 Set the DrupalviewsViewsData::$fullyLoaded property to TRUE only when the data is really loaded.
Task: #3566050 Add cosmicdreams as a maintainer of the Settings Tray subsystem
Fix: #1894286 System updates are executed without priority
Task: #3568888 Remove Wim Leers as maintainer for CKEditor 5, Editor, JSON:API, and REST
Task: #3572244 Add smustgrave as a maintainer of the Options subsystem
Fix: #2722307 Move translation based conditions into database query on revisions overview page
Docs: #3552759 Fix more incorrect phpdoc type hints (part 1)
Fix: #3554220 Claro's libraries don't enforce the variables.css dependency
Fix: #3568566 Olivero's secondary menus inoperable when authenticated & BigPipe present
Fix: #3572084 Dotfiles cannot be ignored cia *.starterkit.yml file
Fix: #3569751 Workspace AJAX query parameters become arrays when form elements have pre-existing token/persist values
Task: #356605

All changes since 11.3.2:
task: #3566054 Add heddn as a maintainer of the Image subsystem
task: #3566053 Add heddn as a maintainer of the Authentication and Authorization subsystem
task: #3566049 Add amateescu as a maintainer of the Workflows subsystem
test: #3571492 Several tests fail on PHP 8.1 on 10.6.x because of requirements issues
fix: #3463524 editor_post_update_sanitize_image_upload_settings fails on missing text format
Reapply "task: #3571196 Update symfony/process constraint"
task: #3570133 PHPUnit security update
Revert "task: #3571196 Update symfony/process constraint"
task: #3571196 Update symfony/process constraint
fix: #3567770 Media Library message persists after deselecting items to fix overflow
docs: #3532469 Documentation mentions Drupal being fully "repaired"
fix: #3566568 The short description for the DrupaluserAccountForm class is not correct
fix: #3569778 Fix link in DrupalTestspackage_managerKernelTestSandboxManager::__sleep doc
fix: #3564510 TypeError: DrupalCoreUtilityThemeRegistry::getGlobalPreprocess(): Return value must be of type array
fix: #3570220 RoleSettingsForm::submitForm() should not load config overrides
fix: #3570219 BlockListBuilder::submitForm() should not load config overrides
fix: #3565213 Adjust contextual CSS for navigation module reset CSS
fix: #3568141 Try to avoid style recalculation in Olivero's isDesktopNav
fix: #3564880 BigPipe placeholders with identical IDs are not all replaced
docs: #3563727 Fix PHPStan missingType.generics for ArrayIterator not specifying its types
feat: #3535230 Reverted revision is not listed on the version history when using Set as current revision
Revert "feat: #3535230 Reverted revision is not listed on the version history when using Set as current revision"
feat: #3535230 Reverted revision is not listed on the version history when using Set as current revision
feat: #3556794 preprocess_HOOK__candidates in themes can be assigned to module invoke maps

All changes since 11.3.1:
performance: #3566156 APCu FileCache can consume a ton of memory due to caching procedural hook data since Drupal 11.1
feat: #3563812 Top bar CSS does not set text colour
task: #3565943 [security hardening] Update composer to 2.9.3
fix: #2339921 Undefined variable: groups in DrupalviewsPluginviewsfilterFilterPluginBase::groupForm
Revert "fix: #2339921 Undefined variable: groups in DrupalviewsPluginviewsfilterFilterPluginBase::groupForm"
perf: #3559030 Installing from existing config causes massive cache.config population and slow installs
fix: #3516264 CKEditor 5 loads all plugin translations on AJAX operations
fix: #3542774 The “reduce motion” setting in the operating system should be respected
fix: #3564548 update_post_update_fix_update_emails() can fail on invalid config
fix: #2339921 Undefined variable: groups in DrupalviewsPluginviewsfilterFilterPluginBase::groupForm
fix: #3565218 [random test failure] ResponsiveImageFieldUiTest::testResponsiveImageFormatterUi()
fix: #3564926 Fix the documentation for SystemAdminMenuBlockAccessCheck::access() first parameter
fix: #3560690 Functional update tests consistently fail on mysqli
task: #3562159 Make it easier to run test-only job against different PHP / DB combinations
fix: #3562676 Fix type hints with wrong case in @param and @return annotations
fix: #3553342 Race condition in LocalTaskManager::getLocalTasks() with fibers
fix: #3555152 Move skip_procedural_hook_scan cleanup to HookCollectorKeyValueWritePass
fix: #3551373 [random test failure] ManageDisplayTest testFormatterUI() and testWidgetUI()
fix: #3557585 Update to Composer 2.9.2
Back to dev.

All changes since Drupal 11.3.0:
fix: #3562753 History module triggers ServiceNotFoundException for comment.manager when Comment module is not enabled
fix: #3563876 TypeError: trigger_error(): Argument #2 () must be of type int, string given in trigger_error()

All changes since Drupal 11.3.0-rc2:
Fix: #3446368 SymfonyMailer RfcComplianceException when sending to multiple comma-separated addresses
Fix: #3558939 options_config_install_test has unnecessary Body field
Fix: #3559059 Add UserAuthenticationInterface alias to user.auth service
Docs: #3496417 Fix PHPStan missingType.generics for FieldItemListInterface not specifying its type
Task: #3549727 Fix LongLineDeclaration in module Controller, Hook and Database directories