drupal 11.0.3

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about Drupal 11.

Drupal 11.0.x will receive security coverage until June 2025.

The Twig templating library has issued a security advisory. Drupal core is not vulnerable, but previous versions of the drupal/core-recommended package only allowed insecure versions of Twig to be installed. This patch release upgrades Twig to 3.14.0 as a public security hardening.

Known issues

• #3471741: Fix null $cid in CacheCollector classes conflicts with Menu Trail by Path, Entity Manager and Gin Toolbar modules.

Important update information

• If you are updating from Drupal 10, refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 11 compatibility of modules, themes and sites. Then, upgrade from Drupal 10 to 11. You should also check the Drupal 11.0.0 release notes.
• If you are updating from 10.2.x or earlier and have the CKEditor font module installed, you should consider switching to CKEditor5 Plugin pack for a more up-to-date version of the plugin which is compatible with the CKEditor5 version shipped with Drupal 10.3.

All changes in this release

• Issue #2386195 by dawehner, samit.310@gmail.com, voleger, daffie, smustgrave, mile23: State has no dedicated test coverage
• Issue #3473195 by longwave, catch, jurgenhaas, naveenvalecha, quietone: twig/twig has a possible sandbox bypass
• Issue #3472092 by nicxvan, smustgrave: Remove references to ApcClassLoader (removed in Symfony 4)
• Issue #3471741 by mstrelan, bbrala, kristiaanvandeneynde: Fix null $cid in CacheCollector classes
• Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests
• Revert "Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests"
• Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests
• Issue #3454507 by hablat, catch: Aggregated asset generation causes uncacheable assets
• Issue #3436526 by skaught, plopesc, kostyashupenko, m4olivei, quietone, godotislate, catch, ckrina, KeyboardCowboy, nod_, longwave: Adjust custom navigation logo dimensions on upload
• Issue #3471977 by grimreaper: Drupal.dialog openDialog should use event settings
• Back to dev.