diff -u b/core/core.libraries.yml b/core/core.libraries.yml
--- b/core/core.libraries.yml
+++ b/core/core.libraries.yml
@@ -391,7 +391,7 @@
 
 jquery.joyride:
   remote: https://github.com/zurb/joyride
-  version: "v2.1-11-gc2b3866"
+  version: "v2.1.1-pre c2b38668fcaf7e549687587de9a549cbb190237b"
   license:
     name: MIT
     url: https://github.com/zurb/joyride/blob/v2.1.0/README.markdown
only in patch2:
unchanged:
--- a/core/lib/Drupal/Core/Asset/JsCollectionRenderer.php
+++ b/core/lib/Drupal/Core/Asset/JsCollectionRenderer.php
@@ -72,7 +72,7 @@ public function render(array $js_assets) {
           break;
 
         case 'file':
-          $query_string = $js_asset['version'] == -1 ? $default_query_string : 'v=' . $js_asset['version'];
+          $query_string = $js_asset['version'] == -1 ? $default_query_string : 'v=' . rawurlencode($js_asset['version']);
           $query_string_separator = (strpos($js_asset['data'], '?') !== FALSE) ? '&' : '?';
           $element['#attributes']['src'] = file_url_transform_relative(file_create_url($js_asset['data']));
           // Only add the cache-busting query string if this isn't an aggregate