drupal 11.3.11

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

This update solves Composer security errors from third party components when installing drupal/core-recommended.

Drupal 11.3.x will receive security coverage until December 2026.

All changes since 11.3.9

• task: #3592421 Update Symfony routing and http-foundation versions
• fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in generated URLs
• task: #3592382 Update Twig to v3.27.0
• task: #3592065 Drupal core-recommended pins vulnerable symfony/polyfill-intl-idn version affected by CVE-2026-46644
• task: #3567980 Remove unneeded parameter $requestStack from EntityController
• Merged 11.3.10.
• fix: #3588331 PsrResponseSubscriber doesn't support \Psr\Http\Message\StreamInterface
• fix: #3301239 Improve the error message thrown in PoStreamReader::readLine() when translations cannot be saved
• Revert "fix: #2844620 Automatically split cache debug headers into multiple lines when they exceed 8k"
• fix: #2844620 Automatically split cache debug headers into multiple lines when they exceed 8k
• docs: #3589633 Remove realityloop from MAINTAINERS.txt
• fix: #3559132 FileSystem::deleteRecursive() leaves files/directories when realpath() returns FALSE
• fix: follow-up #3463868 Two #config_targets error when used on a text_format form element
• fix: #3463868 Two #config_targets error when used on a text_format form element
• fix: #3586099 SystemAdminThemePreprocess::preprocessSystemModulesDetails() shows @theme instead of the theme name that depends on a module
• task: #3588897 Widen the script/stylesheet bytes assertion ranges in performance tests
• Back to dev.