drupal 10.3.13

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-Site Scripting - SA-CORE-2025-001
• Drupal core - Moderately critical - Access Bypass - SA-CORE-2025-002
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-003

This release also fixes Update manager routes are not disabled anymore when allow_authorize_operations is FALSE, a public security improvement.

No other fixes are included.

Which release do I choose? Security coverage information

• Drupal 10.3.x will receive security coverage until June 2025 when Drupal 10.5.0 is released and sites should plan to update to Drupal 10.4, 10.5, or 11 by June 2025.
• Drupal 10.2.x and below are end-of-life and do not receive security coverage.

Important update information

Users now need the “Administer content” permission (administer nodes) to perform certain bulk operations. Alternatively, sites can install the Granular Node Permissions module and grant more specific permissions.