drupal 11.1.9

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
• Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
• Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Important update information

• SA-CORE-2025-005 removes a feature of an underlying library where request attributes can be manipulated. It is possible that some sites are actually relying on this feature. In this case, the behavior can be replicated by implementing a custom stack middleware to alter the incoming request.

• Symfony Framework released CVE-2025-64500 today. Drupal core does not expose this vulnerability.

  Drupal 11.1 has Symfony 7.2 as minimum version, which is no longer supported by Symfony as of this month (November 2025). Since Drupal is not affected by the Symfony security vulnerability, we are not raising the minimum Symfony version for Drupal 11.1. Sites can update to Symfony 7.3 via Composer if needed, or update to Drupal 11.2. Sites should also aim to update to Drupal 11.2 or higher before Drupal 11.1 reaches its end-of-life in December.

Which release do I choose? Security coverage information

• Drupal 11.1.x will receive security coverage until December 2025 when Drupal 11.3.0 is released and sites should plan to update to Drupal 11.2 or higher by December 2025.
• Sites on Drupal 11.2.x should update immediately to Drupal 11.2.8.
• Sites on Drupal 10.5.x should update immediately to Drupal 10.5.6.
• Sites on Drupal 10.4.x should update immediately to Drupal 10.4.9.
• Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage.

Other changes in this release

Additional test-only fixes are included in the release:

• Issue #3539331 by dww, godotislate, nicxvan: Incorrect warning for system requirements for APCu memory
• Issue #3539366 by dimitriskr, andypost, godotislate: Default DB transaction isolation set to read-committed breaks InstallerIsolationLevelExistingSettingsTest test