drupal 11.3.21

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.3.x will be end-of-life soon when Drupal 11.5.0 and 12.0.0 are released. Sites should plan to update to Drupal 11.4.x or 11.5.x soon.

Important update information

• Drupal core's composer.json now includes a replace section for modules that are removed from core in future versions and available as contributed projects instead. This resolves Composer issues for projects that declared a dependency on one of these modules (for example, the Admin Toolbar contributed module).

  This fix was already in previous releases of Drupal 11.4 and 10.6, but was not originally ported to 11.3. Sites that have already worked around this issue using a replace or similar in their own composer.json may need to remove those workarounds in order to upgrade.

• Several Symfony packages have been updated to v7.4.23 to address several upstream security advisories.

• masterminds/html5 has been updated to 2.12.0 to address the following issues:

  • Parser converts safe attributes containing form feed characters into dangerous attributes
  • Quadratic parse-error bookkeeping, unescaped xmlns:* serialization, xmlns TypeError and invalid UTF-8 deletion in masterminds/html5