Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Install
To start a new Drupal project with version 10.3.4:To update your site and all dependencies to the latest version of Drupal:
To update your site to this specific release:
Pinning to a specific release may make it more challenging to update your site in future, see composer documentation for managing pinned versions
Using Composer to manage Drupal site dependencies
Downloads
Download tar.gz
19.85 MB
MD5: a21b74c39d27226c6c2668ee52c45394
SHA-1: f75772ee99356ec8e2b665b2364bb8fb5b3a615e
SHA-256: 150b3858e2e89ffedb38f6ac326e1a7305d5a73b6e9c4382fa56c8558c976fe8
Download zip
32.3 MB
MD5: 42aa036b8c70cc243a49f71b8cfadde5
SHA-1: bcfd4146d8223261889f37a15e370e3e6ccdbfab
SHA-256: ac13cf3844b2802391c343446371d9645cd5078e32fec2df61b2bbf64807d15b
Release notes
This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about Drupal 10.
Drupal 10.3.x will receive security coverage until June 2025.
The Twig templating library has issued a security advisory. Drupal core is not vulnerable, but previous versions of the drupal/core-recommended package only allowed insecure versions of Twig to be installed. This patch release upgrades Twig to 3.14.0 as a public security hardening.
Known issues
- #3471741: Fix null $cid in CacheCollector classes conflicts with Menu Trail by Path, Entity Manager and Gin Toolbar modules.
Important update information
If you are updating from 10.2.x or earlier and have the CKEditor font module installed, you should consider switching to CKEditor5 Plugin pack for a more up-to-date version of the plugin which is compatible with the CKEditor5 version shipped with Drupal 10.3. If you are updating from Drupal 9, refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 10 compatibility of modules, themes and sites. Then, upgrade from Drupal 9 to 10. You should also check the Drupal 10.0.0 release notes.
All changes in this release
- Issue #3473195 by longwave, catch, jurgenhaas, naveenvalecha, quietone: twig/twig has a possible sandbox bypass
- Issue #3472092 by nicxvan, smustgrave: Remove references to ApcClassLoader (removed in Symfony 4)
- Issue #3471741 by mstrelan, bbrala, kristiaanvandeneynde: Fix null $cid in CacheCollector classes
- Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests
- Revert "Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests"
- Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests
- Issue #3454507 by hablat, catch: Aggregated asset generation causes uncacheable assets
- Issue #3472592 by smustgrave: Fix Book breadcrumb cacheability
- Issue #3471977 by grimreaper: Drupal.dialog openDialog should use event settings
- Back to dev.
What’s next?
- Learn how to install Drupal
- Learn how to update Drupal
- Extend Drupal to do more
- Get training
- Check out what others built
Bug fixes
Insecure
