drupal 10.2.11

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Moderately critical - Cross-Site Scripting - SA-CORE-2024-003
• Drupal core - Moderately critical - Access Bypass - SA-CORE-2024-004
• Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

No other fixes are included.

Which release do I choose? Security coverage information

• Drupal 10.2.x will receive security coverage until December 2024 when Drupal 10.4.0 is released and should plan to update to Drupal 10.3, 10.4, or 11 by December 2024.
• Drupal 8 and 9 are end-of-life and do not receive security coverage.

Important update information

As part of the protection against a potential vulnerability, additional checks have been added to some of Drupal core's database related code. If you use a third-party database driver that makes use of the Drupal\Core\Database\StatementPrefetchclass, you may need to allow-list the driver by adding it to settings.php.

Drupal Core's own database drivers (and the contrib sqlsrv driver) do not require additional configuration. The contrib Oracle driver is allow-listed by default.

Example for settings.php:

$settings['database_statement_prefetch_valid_db_drivers'] = ['mydbdriver'];