drupal 11.2.3

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about Drupal 11.

Drupal 11.2.x will receive security coverage until June 2026.

Important update information

• The Composer constraints now allow either PHPStan 1.x or 2.x. In Drupal 11.2.0 the constraints unintentionally removed all compatibility with PHPStan 1.x, which caused issues for continuous integration of many contributed projects. Drupal core is compliant with PHPStan 2.x and may not scan properly on PHPStan 1.x.
• Sites implementing BlockBase::submitConfigurationForm() are no longer required to add a return type. This was unintentionally introduced in 11.2.
• Sites built using the core-recommended package, drupal/core-recommended, can now successfully update to 11.2.0. The constraint on sebastian/diff has been removed. This allows sites to PHPUnit 10 or PHPUnit 11, which require different versions of sebastian/diff.

All changes since 11.2.2

• Issue #3536190 by mherchel, griffynh, smustgrave, proeung, johnalbin: Remove proeung as maintainer for Olivero subsystem
• Issue #3536193 by griffynh, shaal, markconroy: Remove shaal as maintainer for Umami demo subsystem
• Issue #3536188 by ankusht1515, divyansh.gupta, smustgrave, griffynh, dcam, mac_weber: Remove Mac_Weber as maintainer for Link Field subsystem
• Issue #3534832 by xjm, griffynh, jelle_s, smustgrave: Remove Jelle_S as maintainer for Responsive Image subsystem
• Issue #3534831 by xjm, griffynh, dmsmidt, smustgrave: Remove dmsmidt as maintainer for Inline Form Errors subsystem
• Issue #3536751 by xjm, griffynh, yched, alexpott: Remove yched as maintainer for Field UI subsystem
• Issue #3489311 by xjm, bradjones1, smustgrave, alexpott, damiankloip: Remove damiankloip as subsystem maintainer
• Revert "Issue #3511972 by phenaproxima, azizos, quietone, rkoller, pameeela, catch, poker10, tedbow, alexpott, larowlan, gábor hojtsy, mcdruid, xjm, benjifisher, yesct: Allow Composer and rsync location to be configured via the UI"
• Revert "Issue #3534278 by phenaproxima, longwave, xjm: The vendor hardening plugin should provide a way to skip cleaning certain packages"
• Revert "Issue #3537668 by phenaproxima: Dynamically figure out the actual path to Composer's binary, and make it read-only"
• Issue #3538236 by grimreaper, smustgrave: Empty top bar actions dropdown
• Revert "Issue #3362726 by alexpott, oily, jrb, neclimdul: READ COMMITTED requirement check doesn't account for database views"
• Issue #3362726 by alexpott, oily, jrb, neclimdul: READ COMMITTED requirement check doesn't account for database views
• Issue #3526769 by mcdruid, smustgrave: Avoid abuse of config sync import tarballs
• Issue #3533061 by nob, nexusnovaz, joachim: ConditionInterface docs mention nonexistent QueryConditionInterface
• Issue #3539331 by dww, godotislate, nicxvan: Incorrect warning for system requirements for APCu memory
• Issue #3531287 by godotislate, johnwt, cilefen, chike, xjm, catch, longwave, mradcliffe, phenaproxima, moshe weitzman: Remove core/recommended constraint for sebastian/diff
• Issue #3537668 by phenaproxima: Dynamically figure out the actual path to Composer's binary, and make it read-only
• Issue #3002019 by hanoii, dcam, rpayanm, giuseppe87: Register a user without email verification should still send an email
• Issue #3535330 by joelpittet, benabaird: Assets paths in CSS no longer rewritten when aggregation is enabled
• Issue #3506321 by libbna, rkoller, sdhruvi5142, mgifford, ckrina: Increase the color contrast of the toggle button border
• Issue #3043127 by liam morland, mohit_aghera, pancho, smustgrave, xjm, quietone: FileFieldTestBase::assertFileEntryNotExists() should be documented, typehinted, and accept a null value for $message
• Issue #3515661 by quietone, joaopauloscho, xjm, charlliequadros: Fix 'DocComment.MissingShort' in FunctionalJavascript tests
• Issue #3537572 by michagru, joachim: PageVariantInterface docs mention class that doesn't exist
• Issue #3537720 by acbramley, mstrelan: Remove return type from BlockBase::submitConfigurationForm()
• Issue #3535351 by acbramley, nod_, mstrelan: [random test failure] ToolbarActiveTrail::testToolbarActiveTrail
• Issue #3534830 by Bojhan: Remove Bojhan as maintainer for Usability topic
• Issue #3536749 by xjm, griffynh, sun, smustgrave, larowlan: Remove sun as maintainer for Language subsystem
• Issue #3536189 by griffynh, mpdonadio: Remove mpdonadio as maintainer for DateTime and DateTime Range
• Issue #3536192 by rainbreaw, xjm: Remove rainbreaw as maintainer for Accessibility subsystem
• Issue #3536185 by ankusht1515, griffynh, david strauss: Remove David Strauss as maintainer for MySQL DB driver subsystem
• Issue #3537409 by andrewmacpherson, nicxvan: Remove accessibility topic maintainer - andrewmacpherson
• Issue #3537420 by dcam, smustgrave, larowlan: Add dcam as a subsystem maintainer of the Link module
• Issue #3534278 by phenaproxima, longwave, xjm: The vendor hardening plugin should provide a way to skip cleaning certain packages
• Issue #3536939 by phenaproxima, savage1974, thejimbirch: The unpacker chokes on Composer platform dependencies, like `ext-mbstring`
• Issue #3530855 by libbna, rkoller, the_g_bomb: The border of field types on the "add field" step has a too low color contrast
• Issue #3525074 by quietone: Move JSON:API coverage for Contact to the Contact module
• Issue #3534455 by juampynr: Remove juampynr from MAINTAINERS.txt
• Issue #3534386 by sijumpk, griffynh, benjy: Remove benjy as maintainer for Block subsystem
• Issue #3534047 by fathershawn, xjm, nod_: Add fathershawn as a subsystem maintainer for the Ajax subsystem
• Issue #3530043 by catch, xjm, smustgrave, gábor hojtsy, markconroy, ckrina, pameeela: Display Umami warning on all pages (not just admin pages)
• Issue #3521081 by bircher: Deleting a config checkpoint breaks the checkpoint storage
• Issue #3533698 by nod_, longwave, danflanagan8, hammerslammer, wim leers: BigPipe does not handle multiple tags correctly
• Issue #3528139 by phenaproxima, tim.plunkett, catch: Package Manager should use a copy of Composer that is local to the current project, if available
• Issue #3511972 by phenaproxima, azizos, quietone, rkoller, pameeela, catch, poker10, tedbow, alexpott, larowlan, gábor hojtsy, mcdruid, xjm, benjifisher, yesct: Allow Composer and rsync location to be configured via the UI
• Issue #3535199 by alexpott, godotislate: Saving untrusted config results in memory leak
• Issue #3533926 by alexpott: Config of the type plural_label can never be valid due to the label constraint
• Issue #3534893 by quietone: [regression] Wrong doc link on database update page
• Issue #3473029 by dcam, annmarysruthy, igorgoncalves, smustgrave, guillaumepacilly: Wrong maxlength on Authored By field for translation
• Issue #3501582 by phenaproxima, juxelle: Package Manager should always run Composer through the PHP interpreter, rather than directly
• Issue #3504582 by artem_sylchuk, nod_, smustgrave, reinfate, anjaliprasannan, alexdoma: [regression] Tags td, tr or th ignored by new parseHTML implementation
• Issue #3532159 by fathershawn, nicxvan, smustgrave: HTMX behavior attachment fails with some swap strategies
• Issue #3518192 by joville, igorgoncalves, sandip, ressa: Dropdown does not show desired arrow on open state
• Issue #3223147 by kentr, kostyashupenko, nikhil_110, smustgrave, hop, kristen pol: Claro breadcrumb doesn't meet minimum target-size
• Issue #3528994 by annmarysruthy, joachim: hook_views_query_alter() docs missing use QueryPluginBase import
• Issue #3238618 by gauravvvv, rpayanm, Harish1688, tauoms, roshanibhangale, mherchel, quietone: Olivero: Allow primary & secondary navigation focus outline to work with long text
• Issue #3529706 by annmarysruthy, smustgrave, mstrelan: Validatable config job is not aware of OOP hooks
• Issue #3518224 by alecsmrekar, plach: Duplicate path alias when adding node translation
• Issue #3532914 by catch, mondrake: Try to reduce Unit test CPU requests
• Issue #3533030 by catch, mondrake: Move QuickStart tests to build tests
• Issue #3524738 by berdir, xjm, godotislate, oily, catch, penyaskito, larowlan, kristiaanvandeneynde: Fatal error when passing NULL to Renderer::render()
• Issue #3531687 by immaculatexavier, xjm, sam152: Remove Sam152 as maintainer for Content Moderation and Workflows
• Issue #3532704 by griffynh, yoroy: Remove yoroy as maintainer for Usability
• Issue #3532187 by sleitner, immaculatexavier, alexpott, catch, adrianm6254, xjm, sharif.elshobkshy: Composer issue when dealerdirect/phpcodesniffer-composer-installer update from v1.0.0 to v1.1.0
• Issue #3513879 by nicxvan: Convert experimental_module_requirements_test_requirements to new Class
• Issue #3337882 by dcam, enaznin, tirupati_singh, pameeela, catch, smustgrave: Deleted menus are not removed from content type config
• Issue #3532962 by phenaproxima: Ensure that the default content system can import a workspace with content in it
• Issue #3464426 by dcam, kksandr, alexpott: AutowireTrait and autowire for services behave differently for nullable types
• Issue #3529507 by nicxvan, xjm, alexpott: Allow setting memory limit to -1 for phpstan precommit hooks
• Issue #3533300 by mstrelan, xjm: PHPStan baseline is out of sync
• Issue #3490639 by dcam, seanb: Checking for duplicate emails in user_requirements() does not take langcode into account
• Issue #3530154 by mondrake, xjm, borisson_, mstrelan: Fix test classes with no *Test suffix
• Issue #3530262 by mohit_aghera, kim.pepper, quietone, xjm: Add mohit_aghera as File sub-system co-maintainer
• Issue #3531022 by mondrake: Let run-tests.sh print db type and version in the initial output
• Issue #3447550 by brandonlira, sadamafridi, charlliequadros, joachim, santhosh@21: defaultStorageSettings() and defaultFieldSettings() should document that they must not have setting names in common
• Issue #3530149 by xjm, smustgrave, larowlan, bramdriesen, benjifisher, longwave, mcdruid, catch, alexpott: Add tests for SA-CORE-2025-004: Link field attribute XSS
• Issue #3525642 by amateescu, smustgrave: The active workspace is not persisted for the entire lifecycle of a form
• Issue #3532796 by alexpott, jurgenhaas, rkoller: Composer unpack plugin runs into issue when requiring a dev-release of a module
• Issue #3055319 by idebr, mmbk, cilefen, quietone, catch: Constraint violations are not triggered for Roles on a user's account form
• Issue #3530276 by mstrelan, smustgrave, xjm: Add return types to CookieResourceTestTrait
• Issue #3196798 by acbramley, juhog, ranjith_kumar_k_u, paulocs, smustgrave, alexpott, catch: Fix EntityController::addPage so bundles are sorted by label and not ID
• Issue #3465041 by prudloff, xjm, smustgrave, larowlan: FormState::getTriggeringElement() behaves inconsistently when request is malformed
• Issue #3532698 by mondrake, acbramley, xjm, catch, cmlara: phpstan dev constraints make it difficult for modules to support 11.2 and below
• Issue #3527408 by prudloff, smustgrave, xjm, benjifisher, catch, kim.pepper, larowlan: Add test for SA-CORE-2024-002
• Issue #3532916 by catch: Unpack recipe test is in the wrong namespace (Tests vs BuildTest)
• Issue #3008943 by tim.plunkett, amateescu, brandonlira, sahil.goyal, yogeshmpawar, smustgrave, alexpott, ameymudras: Clean up todo in InlineBlockEntityOperations::handleEntityDelete()
• Issue #2077977 by mohit_aghera, plopesc, er.pushpinderrana, nielsonm, xjm, smustgrave: Use FormBase class for the test module's form in file.module
• Issue #3505049 by nicxvan, godotislate, raveen_thakur51, sher1, catch, jnicola, johnv, reinimax, rudi teschner: Drupal 11.1.2 upgrade causes \Drupal::$container is not initialized yet error
• Issue #3531688 by gabesullice, griffynh: Remove gabesullice as maintainer for JSON:API
• Issue #3532532 by lauriii: Remove lauriii as subsystem maintainer of CKEditor 5 and Claro
• Back to dev.