drupal 10.5.10

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• SA-CORE-2026-004

Important update information

This release also updates several dependencies for upstream security releases:

• Twig is updated to 3.26.0 for a Twig security fixes that were released today. Drupal core is affected by these vulnerabilities, so Drupal core's composer.json constraint for Twig has also been increased.

  It is recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.

• Symfony is updated to 6.4.40 for Symfony security fixes that were released today. Drupal core is affected by some of these vulnerabilities, so Drupal core's composer.json constraints for some Symfony packages have also been increased.

• This release updates the pinned versions of Composer to 2.9.8 for a Composer security fix that was released recently. Drupal core does not expose this vulnerability, but the update is included as a hardening for other applications that may extend the library directly.

• underscore.js has been updated to 1.13.8 as hardening for a security issue in that project. This update was previously committed to 11.3, but not backported.

Which release do I choose? Security coverage information

• Drupal 10.5.x will receive security coverage until June 2026.
• Sites on Drupal 11.3.x should update immediately to Drupal 11.3.10.
• Sites on Drupal 11.2.x should update immediately to Drupal 11.2.12.
• Sites on Drupal 11.1.x should update immediately to Drupal 11.1.10. (see note)
• Sites on Drupal 11.1.x should update immediately to Drupal 11.1.10. (See note below.)
• Sites on Drupal 10.6.x should update immediately to Drupal 10.6.9.
• Sites on Drupal 10.4.x should update immediately to Drupal 10.4.10. (See note below.)

Note that Drupal 11.1.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. However, due to the severity of the above security issue, releases for 11.1.x and 10.4.x are being provided as a one-time best effort to help sites upgrade as quickly as possible.