drupal 11.4.12

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until April 21, 2027 rather than June 2027. (More information on recent changes to security support for Drupal minor versions.)

Important update information

• Several Symfony packages have been updated to v7.4.23 to address several upstream security advisories.

• masterminds/html5 has been updated to 2.12.0 to address the following issues:

  • Parser converts safe attributes containing form feed characters into dangerous attributes
  • Quadratic parse-error bookkeeping, unescaped xmlns:* serialization, xmlns TypeError and invalid UTF-8 deletion in masterminds/html5

All changes since 11.4.11

• task: #3635859 Update lockfile versions of Symfony versions in supported 11.x and 10.x versions
• fix: #3633186 [regression] core/scripts/dr and core/scripts/drupal fail to find the autoloader when the docroot is web/
• fix: #3625458 Form error text in dark mode has low contrast
• fix: #3620907 Logo and navigation icons don't align in the collapsed sidebar
• task: #3633064 Update masterminds/html5 to 2.12.0
• task: #3633167 Add test coverage for SA-CORE-2026-008
• task: #3633170 Add test coverage for SA-CORE-2026-006
• task: #3633178 Add test coverage for SA-CORE-2026-002
• fix: #3627936 Active workspace has a broken styling in dark mode
• task: #3633157 Add test coverage for SA-CORE-2026-011
• task: #3633156 Add test coverage for SA-CORE-2026-012
• task: #3633173 Add test coverage for SA-CORE-2026-005
• task: #3633166 Add test coverage for SA-CORE-2026-009
• task: #3633160 Add test coverage for SA-CORE-2026-010
• task: #3633176 Add test coverage for SA-CORE-2026-004
• fix: #3631472 Fix description of the definition in IconPackManager::validateDefinition
• fix: #3609975 UrlHelper::uncompressQueryParameter() should set a gzuncompress() character limit