Install
To start a new Drupal project with version 10.6.7:To update your site and all dependencies to the latest version of Drupal:
To update your site to this specific release:
Pinning to a specific release may make it more challenging to update your site in future, see composer documentation for managing pinned versions
Using Composer to manage Drupal site dependencies
Downloads
Download tar.gz
20.43 MB
MD5: 876da370e3d06fd74a95084922bad3fb
SHA-1: 0553cbe02f77050b24600cc2b443c93a60dcb366
SHA-256: ab5f3ec17275bc4f7e83f0441d460c8cb3f6ebbd45de0d71e1cacda32a7546b7
Download zip
33.72 MB
MD5: 93d1932fc02ddfb07741319f8018be1a
SHA-1: 76f0dd1197d13b3dd9ea33217b2c4b080d9297cc
SHA-256: c533552562290725c6255cc0cf6731637fe415ad92d0eb162c73e115639a85a8
Security issues fixed
Release notes
This is a security release of the Drupal 10 series.
This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:
- Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
- Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Important update information
-
This release updates the pinned versions of Composer to 2.9.7 for several Composer security fixes that were released today. Drupal does not expose these vulnerabilities, but the update is included as a hardening for other applications that may extend the library directly.
No other fixes are included.
Which release do I choose? Security coverage information
- Drupal 10.6.x will receive security coverage until December 2026 when Drupal 10 is end-of-life.
- Sites on Drupal 11.3.x should update immediately to Drupal 11.3.7.
- Sites on Drupal 11.2.x should update immediately to Drupal 11.2.11.
- Sites on Drupal 10.5.x should update immediately to Drupal 10.5.9.