drupal 11.3.5

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.3.x will receive security coverage until December 2026.

Important update information

CKEditor5 is updated to v47.6.0. This version includes a security update for a Cross-Site Scripting (XSS) vulnerability in the General HTML Support feature. The Drupal Security Team have reviewed the update and do not consider it to be exploitable in the built-in implementation of CKEditor5. If you have a custom implementation of CKEditor5 then we recommend reading the Security advisory for workarounds.

This release also fixes an incompatibility with the Pathauto contributed module that was present in Drupal 11.3.4.

All changes since 11.3.3

• Revert "fix: #3525391 Conditions plugin validation schema is wrong"
• fix: #3117430 file-link template should not always display file_size
• task: #3576995 Update CKEditor 5 to 47.6.0
• fix: #3572047 "Last" pager links inside a modal do not open in the modal
• fix: #3319212 Entities without labels cause TypeError in EntityController title callbacks
• fix: #3576074 Current user is changed unexpectedly (follow-up)
• fix: #3576074 Current user is changed unexpectedly
• fix: #3573953 LogicException in Renderer::render() still mentions renderPlain()
• fix: #3525391 Conditions plugin validation schema is wrong
• fix: #3439643 Improve how and what navigation block titles are communicating to screenreader users
• fix: #3558934 Fix styling of link autocomplete with long titles
• fix: #3560659 HTMX Drupal behaviors are not applied when swapped element is body
• fix: #3564735 Container / service exceptions while installed from existing config
• fix: #3575066 Olivero mobile close button not properly placed against top nav bar
• fix: #3562072 Menu link content export with dependencies doesn't include parent menu link entity.
• task: #3572169 Put the mobile sidebar close button into the TAB sequence
• fix: #3565020 Set the Drupal\views\ViewsData::$fullyLoaded property to TRUE only when the data is really loaded.
• task: #3566050 Add cosmicdreams as a maintainer of the Settings Tray subsystem
• fix: #1894286 System updates are executed without priority
• task: #3568888 Remove Wim Leers as maintainer for CKEditor 5, Editor, JSON:API, and REST
• task: #3572244 Add smustgrave as a maintainer of the Options subsystem
• fix: #2722307 Move translation based conditions into database query on revisions overview page
• docs: #3552759 Fix more incorrect phpdoc type hints (part 1)
• fix: #3554220 Claro's libraries don't enforce the variables.css dependency
• fix: #3568566 Olivero's secondary menus inoperable when authenticated & BigPipe present
• fix: #3572084 Dotfiles cannot be ignored cia *.starterkit.yml file
• fix: #3569751 Workspace AJAX query parameters become arrays when form elements have pre-existing token/persist values
• task: #3566056 Add markconroy as a maintainer of the Markup subsystem
• task: #3568891 Add markconroy as a maintainer of the Settings Tray subsystem
• fix: #3567159 Fix "expects array" issues detected by phpstan
• fix: #3572527 \Drupal\DrupalInstalled::VERSIONS_HASH is not consistent for the same set of packages
• fix: #3570287 Use appropriate config schema for the Display comment (display_comment) property
• fix: #3566280 Color contrast issues on the field listings page
• task: #3566057 Add mstrelan as a maintainer of the System (module) subsystem
• task: #3571815 Add amateescu as a maintainer of the Content Moderation subsystem
• fix: #3565886 Navigation module throws an error on missing URL
• fix: #3545132 Datelist element has nondeterministic timezone
• docs: #3118569 Add an example of a semver contrib module number to the update hook example for hook_removed_post_updates()
• docs: #3565566 Document return type for RfcLogLevel::getLevels()
• task: #3566052 Add dww as a maintainer of the Content Moderation subsystem
• Back to dev.