Install
To start a new Drupal project with version 11.2.11:To update your site and all dependencies to the latest version of Drupal:
To update your site to this specific release:
Pinning to a specific release may make it more challenging to update your site in future, see composer documentation for managing pinned versions
Using Composer to manage Drupal site dependencies
Downloads
Download tar.gz
19.31 MB
MD5: 9d3ba31874206ba768047ee0ac8aec49
SHA-1: 214706e8736e61528bc9d1007c96e21be9717308
SHA-256: 4cee2f4c29680a88ac0de89a3354a40c1591f5fa78896b029ad985b99931f039
Download zip
33.09 MB
MD5: eda1972f1eb40e75687bf0c3243f6a40
SHA-1: a115d11a3b9b84d67e1d2b8cb4b1a7699d63ae36
SHA-256: e3858c7244780345269a9b7010ea004fa620d35e0e89f34d1fc84e8df5803c3b
Security issues fixed
Release notes
This is a security release of the Drupal 11 series.
This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:
- Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
- Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Important update information
-
This release updates the pinned versions of Composer to 2.9.7 for several Composer security fixes that were released today. Drupal does not expose these vulnerabilities, but the update is included as a hardening for other applications that may extend the library directly.
No other fixes are included.
Which release do I choose? Security coverage information
- Drupal 11.2.x will receive security coverage until June 2026 when Drupal 11.4.0 is released.
- Sites on Drupal 11.3.x should update immediately to Drupal 11.3.7.
- Sites on Drupal 10.6.x should update immediately to Drupal 10.6.7.
- Sites on Drupal 10.5.x should update immediately to Drupal 10.5.9.
- Drupal 11.1.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage.