drupal 10.0.3

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about Drupal 10.

Drupal 10.0.x will receive security coverage until December 2023.

Important update information

If you are updating from Drupal 9, refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 10 compatibility of modules, themes and sites. Then, upgrade from Drupal 9 to 10. You should also check the Drupal 10.0.0 release notes.

Important changes since 10.0.2

• Symfony dependencies have been updated to 6.2.6.

• PHPStan has been updated to 1.9.9.

All changes since 10.0.2

• Issue #3338301 by catch, longwave, benjifisher, jungle: Update Symfony to v6.2.6 / v4.4.50
• Issue #2867796 by murilohp, kkalashnikov, sophiavs, ameymudras, Ratan Priya, anagomes, alexpott, joachim: hook_theme() docs for path are inaccurate
• Issue #3087868 by Charlie ChX Negyesi, Wim Leers, joachim, smustgrave: Make the AccessResult API even clearer
• Issue #3337327 by Spokje: CSpell dictionary is out of sync
• Issue #3336002 by Gauravvv, nidhi27, bnjmnm: Claro: Select list chevron-down icon is showing on wrong position in RTL dir in views
• Issue #3130751 by stefanos.petrakis, Medha Kumari, larowlan, alexpott, jungle: Fix LanguageNegotiationContentEntity::getLangcode() errors thrown
• Issue #3178919 by andregp, AndyF, codebymikey, ankithashetty, Ankit.Gupta, alexpott, smustgrave, larowlan: Can't run tests with XDEBUG_CONFIG set to empty string
• Issue #3001430 by alexpott, _utsavsharma, lauriii, Oscaner, catch, smustgrave, ifux, deviantintegral, pameeela: Unable to uninstall base theme and subtheme via config sync at the same time
• Issue #3001430 by alexpott, _utsavsharma, Oscaner, lauriii, smustgrave, ifux, deviantintegral, pameeela: Unable to uninstall base theme and subtheme via config sync at the same time
• Issue #2574981 followup by xjm: Fix 'TTests'.
• Issue #2574981 by Manjit.Singh, dimaro, wengerk, darol100, izus, pguillard, vsujeetkumar, Himanshu5050, snehi, paulocs, rakesh.gectcr, jofitz, _utsavsharma, charginghawk, rajeshwari10, sdstyles, quietone, benjifisher, marcusvsouza, LoMo, joelpittet, justAChris, cilefen, YesCT, mradcliffe, spitzialist, annajl, jhodgdon, catch, alexpott, Sabbi0612, kattekrab, Mile23, antojose, leanderl, rodrigoac: Fix grammar ("an URL" should be "a URL") and consistent use of URL (not "url" / "Url") in documentation only
• Issue #3334525 by Wongjn, Gauravvv: Views UI filter form arrow positioned incorrectly in Claro
• Issue #3305706 by znerol, SandeepSingh199, ivnish, smustgrave, Spokje, økse, ranjith_kumar_k_u, coffeemakr, DavorHorvacki: Uncaught TypeError: this.$pluginSelect.find(...)[0] is undefined
• Issue #3126127 by stefanos.petrakis, andypost, xjm, pooja saraah, Kristen Pol: Fix LanguageNegotiationMethodInterface::getLangcode() result docblock
• Issue #3333401 by nicxvan, bnjmnm: Pager h4 causes accessibility flag on many pages
• Issue #3294619 by mohit_aghera, Kasey_MK, smustgrave, alexpott: Missing schema for comment_link_approve views field configuration
• Issue #2895124 by xjm, lauriii, joaopauloc.dev, Berdir: Field storage settings give a scary red warning that they can't be changed when the cardinality is the only thing with restrictions
• Issue #3092672 by _utsavsharma, apaderno, xjm, smustgrave: Remove outdated @todo from the Locale module
• Issue #1875020 by longwave, David_Rothstein, slip, alexpott, catch, smustgrave, jhodgdon: Cron queue gets processed every time cron is called, regardless of whether it's already being processed elsewhere
• Issue #3334679 by Lugir: A minor code comment mistake in NodeFieldAccessTest.php
• Issue #3191389 by anmolgoyal74, greggles, larowlan, mcdruid, pwolanin, brayfe: File Inclusion issue security hardening
• Issue #3333858 by miiimooo, larowlan: Blocks that have #attached set removed after upgrade
• Issue #3087006 by longwave, lauriii, alexpott: Drop .stylelintignore in 10.x
• Back to dev.
• Merged 10.0.2.
• Issue #3185640 by lucienchalom, jungle, smustgrave, ravi.shankar, andregp, xjm, quietone, sergiogsanchez: Fix or ignore words that start with "v", excluding real non-English words
• Issue #3191623 by mondrake, Medha Kumari, daffie, alexpott: Select queries do not escape the GROUP BY fields
• Issue #3088168 by DuaelFr, dww, Ambient.Impact, alexpott: Media thumbnail dimensions are wrong for YouTube videos
• Issue #3260391 by huzooka, arunkumark, Spokje, quietone: BlockedIp::import violates MigrateDestinationInterface::import
• Issue #3328593 by Wongjn, mherchel, andy-blum: Responsive grid children overflow when min-width is greater than container width
• Issue #3332712 by Liam Morland, DanielVeza: Cron links point to D7 documentation
• Issue #3248575 by mfb, xjm: Documentation conflict re: affected rows vs. matched rows
• Issue #3333065 by Spokje: Update PHPStan to 1.9.9 to fix 10.x "updated deps" Drupal CI runs
• Issue #3317938 by catch, Lendude, nod_, quietone: views_ui LibraryCachIngTest is failing randomly
• Issue #3332447 by xjm, Spokje: Upgrade yarn dependencies to fix vulnerabilities shown by yarn audit
• Issue #992540 by valthebald, ndobromirov, jec006, kid_icarus, rickmanelius, mr.baileys, pguillard, joseph.olstad, vijaycs85, paulocs, voleger, Matt V., aerozeppelin, ravi.shankar, quietone, Munavijayalakshmi, ranjith_kumar_k_u, evilehk, swentel, gaurav.kapoor, yogeshmpawar, klidifia, pradhumanjainOSL, louis-cuny, catch, Everett Zufelt, alexpott, cilefen, xjm, grendzy, cashwilliams, borisson_, lachezar.valchev, tstoeckler, Heine: Nothing clears the "5 failed login attempts" security message when a user resets their own password
• Issue #3219472 by quietone, Abhishek_Singh, karishmaamin, longwave, smustgrave, xjm: Fix spelling for words used once, beginning with 'e' -> 'i', inclusive
• Issue #3226334 by albertosilva, pauger, xjm, smustgrave, K3vin_nl, krisahil: PathAliasManager could not find the alias by the internal path
• Issue #3327974 by Lendude, ExTexan: The $entity_type property is protected, so fix views.api.php sample code to use a getter
• Issue #3323353 by Lendude, ameymudras, VitaliyB98, xjm, andypost: View combine filter operator "Is not equal to" use the same operator as "Is equal to"
• Issue #3331900 by noorulshameera, anmolgoyal74: Remove unused variable $translation from BulkFormTest
• Issue #3331818 by xjm, Spokje: commit-code-check.sh gives unclear output when CSS is not properly rebuilt
• Issue #3244737 by longwave, droplet, andypost, joshua1234511, Satyajit1990, klonos: "core/drupal.checkbox" (misc/checkbox.js) has never loaded on user permission page
• Issue #3324901 by alexpott: TestSettingSummariesContentType has a few problems
• Issue #3327853 by Spokje, fabiansierra5191, xjm, longwave, bbrala, rpayanm: Don't allow {@inheritDoc} annotation in PHPDocBlocks
• Issue #3331438 by acbramley, mstrelan: Incorrect return type in LinkBase::getDefaultLabel()
• Issue #3326778 by Graber, Wim Leers, Web-Beest, catch: TypeError: Drupal\ckeditor5\HTMLRestrictions::__construct(): Argument #1 ($elements) must be of type array, Drupal\ckeditor5\HTMLRestrictions given
• Issue #3326371 by Spokje: [10.0.x backport] Fix PHPStan L1 error "Anonymous function has an unused use $foo."
• Issue #3310555 by jonathan1055, smustgrave: htmlspecialchars(): Passing null to parameter #1 ($string) of type string is deprecated
• Issue #3304378 by bnjmnm: Core FunctionalJavascript tests should not depend on Classy or Starterkit