Install

Works with Drupal: ^8.8 || ^9 || ^10 || ^11 || ^12

Using Composer to manage Drupal site dependencies

Alternative installation files

Download tar.gz 60.96 KB
MD5: 120b68f40affaa90657b156c7b486d9b
SHA-1: d25082cf6cdf86d5c7507f1d4d0eea9dbb6166ce
SHA-256: 6328ac1fb90247a409b0dbb5b0d8cd08327565f104a97fdf6bf52a2088bf9f1d
Download zip 100.74 KB
MD5: 754aca1dd40f59867790461c257bc2f9
SHA-1: 8d725d8b919bc9104b87c4ea212febfa92a97cc2
SHA-256: f15fb43e2c3cab29df7fe5221b7122a98c07f5187c851a27f58abd2b4733bd36
Downloads are for manual installation, which is not recommended when using Drupal 8 or later.

Security issues fixed

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the following security announcements and release notes:

Release notes

Security release

This release fixes a security issue. See the security advisory for this release for details.

Permission changes

  • The administer custom formatters permission is now marked as restricted access. It still grants full access to all formatters and engines.
  • Formatter access is split into per-operation permissions: create custom formatter, edit custom formatters, delete custom formatters and view custom formatters. On their own these reach only the lower risk engines, HTML+Token and Formatter Preset.
  • The PHP and Twig engines each need an extra restricted permission on top of the base one, create and edit php custom formatter or create and edit twig custom formatter. This applies to creating, editing and deleting a formatter of that type alike, because the Preview button is reachable from the edit form as well as the add form.

Upgrading

You do not need to change any configuration. All new permissions are additive, administer custom formatters is unchanged, and no role gains the new engine specific permissions automatically on upgrade.

Addresses #2777579.

Created by: deciphered
Created on: 20 Oct 2026 at 21:12 UTC
Last updated: 21 Oct 2026 at 17:38 UTC
Git tag 4.2.1
Security update

Other releases