drupal 10.6.4

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 10.6.x will receive security support until December 2026. Drupal 10.5.x will continue to receive security support until June 2026.

Drupal 10.4.x security support has ended. Sites on any Drupal version prior to 10.5.x should upgrade to a supported release as soon as possible.

Important update information

CKEditor5 is updated to v47.6.0. This version includes a security update for a Cross-Site Scripting (XSS) vulnerability in the General HTML Support feature. The Drupal Security Team have reviewed the update and do not consider it to be exploitable in the built-in implementation of CKEditor5. If you have a custom implementation of CKEditor5 then we recommend reading the Security advisory for workarounds.

All changes since 10.6.3

• task: #3576995 Update CKEditor 5 to 47.6.0
• fix: #3525391 Conditions plugin validation schema is wrong
• fix: #3549107 Escape or strip control characters in JSON:API
• task: #3566050 Add cosmicdreams as a maintainer of the Settings Tray subsystem
• task: #3568888 Remove Wim Leers as maintainer for CKEditor 5, Editor, JSON:API, and REST
• task: #3572244 Add smustgrave as a maintainer of the Options subsystem
• task: #3566056 Add markconroy as a maintainer of the Markup subsystem
• task: #3568891 Add markconroy as a maintainer of the Settings Tray subsystem
• fix: #3570287 Use appropriate config schema for the Display comment (display_comment) property
• task: #3566057 Add mstrelan as a maintainer of the System (module) subsystem
• task: #3571815 Add amateescu as a maintainer of the Content Moderation subsystem
• task: #3566049 [patch to be ported] Add amateescu as a maintainer of the Workflows subsystem
• task: #3566052 Add dww as a maintainer of the Content Moderation subsystem
• Back to dev.