drupal 10.0.0-alpha7

Install

To start a new Drupal project with version 10.0.0-alpha7@alpha:

To update your site and all dependencies to the latest version of Drupal:

To update your site to this specific release:

Pinning to a specific release may make it more challenging to update your site in future, see composer documentation for managing pinned versions

Using Composer to manage Drupal site dependencies

Downloads

Download drupal-10.0.0-alpha7.tar.gztar.gz 18.23 MB

MD5: f3685e403658b07c8a615c7cea2c6ac1

SHA-1: 87695455797f94760444930a4a6df121d69282d7

SHA-256: d86d514aa7a0771e6514f0e205fddcbe6ddef016c84df9f6e4a8e0c3b865f4a4

Download drupal-10.0.0-alpha7.zipzip 30.42 MB

MD5: 8708d85133bf2cfb6d157e0babc0e31d

SHA-1: afd126b88da67cbfbac7e7853495e78e802a590c

SHA-256: fe235cfaf1b1c82c068dadc6bee142f0077815f7ac778df4f9828cdc136f544b

Release notes

This is an alpha release for the next major version of Drupal. This alpha release is intended for module or theme authors to test whether their code is compatible with recent significant changes in Drupal 10.0.x. Drupal 10 alpha releases should not be used in production. No upgrade path will be provided between Drupal 10 alpha releases, nor to Drupal 10.0.0-beta1.

This release fixes security vulnerabilities present in 10.0.0-alpha6. Sites are urged to update immediately after reading the notes below and the security announcements:

Additionally, this release also updates core dependencies for the following third-party security advisories:

This alpha includes many changes that are also included in Drupal 9.5.x.

Several more breaking changes will be added before Drupal 10.0.0-beta1

Drupal 10 alphas do not include all the breaking changes that will be included in 10.0.0. Any further alpha releases as well as the first beta release will include more dependency updates and remove more APIs that are (or that will be) deprecated in Drupal 9, including several core modules and themes that will be moved to contributed projects. Refer to How to prepare your Drupal 7 or 8 site for Drupal 9 for tools you can use to check the Drupal 10 compatibility of modules, themes, and sites.

Specific, highly disruptive changes that are not complete in 10.0.0-alpha7:

CKEditor 4 will be removed from Drupal 10 core, and content created with CKEditor 4 might not work in CKEditor 5 because of upstream changes. You must either install the CKEditor 4 module in contrib (which will receive security fixes until Drupal 9's end-of-life in 2023), or update your site and content to CKEditor 5. There is a beta-stability CKEditor 5 module available for testing in Drupal 9 and 10.
Various core modules and themes will be moved to contributed projects.
Numerous JavaScript libraries and APIs will be removed, including the JavaScript build step.

For more information on 10.0.x development, see #3118143: [meta] Release Drupal 10 on December 14... or 15... 2022.

The 10.0.x branch also includes all the latest commits that will be backported to 9.5.x and earlier branches. 10.0.x will be nearly identical to 9.5.x except for the following:

Deprecated code will be removed, including entire deprecated modules.
Dependencies will be updated to new major versions as appropriate.

For all other changes, refer to the 9.5.x branch.

Important update information

For additional changes from Drupal 9, review the release notes of the previous alpha releases:

Changes to site-owner-managed files

Following this release, Drupal will assume by default that custom stream wrappers (like Remote Stream Wrapper or Flysystem, among many others) should be private by default so that Drupal will manage downloads and access control. If a module intentionally wishes to serve files with no access checking or management by Drupal, the module should implement hook_file_download().

Since various contributed stream wrapper modules might not be able to update immediately, site owners may also specify which stream wrappers should be treated as public stream wrappers (with no access control). If content from a stream wrapper on your site stops working after this update, you can add the following line to settings.php:
```
$settings['file_additional_public_schemes'] = ['example'];
```
…where example is replaced by the name of the affected stream wrapper. (For example, s3 or https.) The name of the stream wrapper will depend on the affected module and its configuration.

You should also locate or submit an issue in the module's queue to implement hook_file_download() for SA-CORE-2022-012.
If the private files directory is inside the public files directory (e.g. drupal/sites/files/private), a site file field misconfiguration or other issue might lead to the site relying on the previous access bypass. If parts of your file or image content become inaccessible after this release, add the following line to your site's settings.php:
```
$settings['sa_core_2022_012_override'] = TRUE;
```
This setting is a temporary backward-compatibility layer for misconfigured sites and will be removed in a future release. In the long term, you should migrate your uploaded files to the correct public or private directories.
Drupal\Component\Assertion\Handle will be deprecated in a future release. For this reason, example.settings.local.php has been updated to change the default assertion handling from:
```
assert_options(ASSERT_ACTIVE, TRUE);
\Drupal\Component\Assertion\Handle::register();
```
to:
```
assert_options(ASSERT_ACTIVE, TRUE);
assert_options(ASSERT_EXCEPTION, TRUE);
```
Site owners using settings.local.php for development sites should update their workflow with this change.

Platform requirements changes

PHP versions 8.1.0-8.1.5 have a bug with the PHP OPcache that may cause intermittent fatal errors at runtime for class autoloading. Therefore, the minimum recommended PHP version for Drupal 9.5 and above has been increased to 8.1.6.

Composer integration changes

Drupal no longer specifies core modules in the 'replace' section of composer.json. This allows contributed versions of core modules to be downloaded with the canonical namespace using Composer.

Changes to CKEditor integration

Previously, plugin settings for all CKEditor 4 plugins were stored in the editor configuration. This included disabled plugins.
To keep the editor configuration in a consistent state, plugin settings are now only stored for CKEditor plugins that are enabled. Stored editor configuration entities were updated in Drupal 9.4.4 to remove the disabled plugin data.
This change allows data created with CKEditor 4 to be updated to CKEditor 5, without the CKEditor 4 module being installed.
To ensure CKEditor data is upgraded to CKEditor 5 correctly, sites using CKEditor should update to Drupal 9.4.4 or higher prior to updating to Drupal 10.

Dependency updates

CKEditor 5 has been updated from 34.1.0 to 35.0.1 for a security update. This update also introduces backwards compatibility breaks, so maintainers of CKEditor 5 integrations should review the CKEditor 35.0.0 release notes.
egulias/email-validator has been upgraded to 3.2.1. Support for 2.1 is removed as the version is no longer supported by the upstream project.
symfony/http-foundation has been updated to 6.1.3 to resolve a bug with destructable services.
Core's jQuery UI assets have been updated from 1.13.1 to 1.13.2 for a security update. (The security issue does not affect Drupal core.)

Development dependencies

Core now requires composer/composer 2.3.6 (up from 2.3.5) for PHP 8.2 support. The installed version has been updated to 2.3.10.
Core now requires version 1.8.2 of the phpstan/phpstan development dependency (up from 1.6.8), version 1.1.25 of mglaman/phpstan-drupal (up from 1.1.21), and 1.6.11 of mikey179/vfsstream (up from 1.6.8). These updates are necessary for automated tests to run on PHP 8.2.
cspell has been updated from version 5 to 6. This results in some slight changes to the dictionary for core development.
Terser has been updated from 5.3.4 to 5.14.2 to address several security issues.

Removed dependencies

Drupal 10 has dropped support for Internet Explorer 11. This includes deprecating all polyfill libraries in Drupal 10 and removing the files. If you plan to continue supporting Internet Explorer 11 even when used with Drupal 10, your project will have to depend on or implement any required polyfills directly.
In Drupal 10, the details HTML tag is available in all supported browsers, so the supporting code that provided this element for Internet Explorer has been removed.