drupal 12.0.0-beta2

This is a beta release for the next major version of Drupal. Drupal 12 beta releases are intended for site owners and module or theme authors to test compatibility and upgrade paths for Drupal 12.0. Beta releases are not intended for production.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Remote code execution - SA-CORE-2026-014
• Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
• Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Important update information

Refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 12 compatibility of modules, themes, and sites. For more information on 12.0.x development, see [meta] Release Drupal 12 in 2026.

• The obsolete Navigation Top Bar module has been removed from core. Sites with this module enabled should uninstall it prior to updating to 12.0.0-beta2.

• Database queries can no longer be serialized following the removal of the __sleep() and __wakeup() magic methods on the Query class.

All changes since Drupal 12.0.0-beta1

• Follow-up for SA-CORE-2026-016: update performance tests.
• fix: SA-CORE-2026-016
• fix: SA-CORE-2026-015
• fix: SA-CORE-2026-014
• task: #3575642 Always free up old container on rebuild, not only in the installer
• task: #3613394 PHPUnit 13.2 - Replace expectExceptionMessage() with expectExceptionMessageIs*() in Component tests
• task: #3625895 Deprecate and remove Query::__wakeup() and ::__sleep()
• task: #1411074 Allow kernel tests to share the test environment
• fix: #3344629 Passing null to parameter #1 ($haystack) of type string is deprecated
• task: #3626105 Release runtime theme registries after destruction
• task: #3563359 Explore why PHP 8.4 polyfill is not loaded for test runs on PHP 8.3
• task: #3625015 Convert final test .modules
• fix: #3626548 Fix RunInSeparateProcesses typos
• task: #3627057 Remove the navigation_top_bar module from core
• fix: #3626740 AccessManager should (once again) bail out early to save resources and avoid adding cacheable metadata for no reason
• fix: #3622958 Target can be null in htmx-assets.js
• task: #2079245 Provide better explanation of plugin configuration array for the PluginBase constructor, and reference plugin API docs
• task: #3081025 Remove technical debt and complication from when doTrustedCallback() could either trigger errors or throw exceptions
• task: #3627134 Delete WorkspacesRequirements