drupal 11.4.0-rc2

This is a release candidate for the next minor version (feature release) of Drupal 11. Release candidates are not supported for production sites, but they are intended for widespread testing in preparation for the upcoming stable release. More information on release candidates.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - PHP object injection - SA-CORE-2026-005
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
• Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
• Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
• Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

Important update information

• This release also updates dependencies for upstream security releases:

  • guzzlehttp/psr7 is updated to 2.11.0 for a guzzlehttp/psr7 security fix.

• Sites using URL discovery for Media oEmbed providers must add an additional media_oembed_discovery_trusted_host_patterns entry to settings.php for their list of known oEmbed providers (like YouTube and Vimeo). It is an array containing a series of regular expressions for matching host names for discovery. It follows the same pattern as the existing trusted hosts settings.

  Example:

  // Only allow URL discovery from example.com.
  $settings['media_oembed_discovery_trusted_host_patterns'] = [
    '^example\.com$',
  ];
  

  Most sites likely use providers.json to define their known oEmbed providers instead, and do not require this change.

Other changes since Drupal 11.4.0-rc1

• task: #3587564 Move search functionality from node to Search module
• fix: #3400181 [regression] calling TypedConfigManager::getDefinition() causes cache pollution
• fix: #3600694 locale_translate_file_attach_properties() BC layer incorrectly always sets override langcode to undefined
• fix: #3590050 Deprecate and replace locale_status related functions
• task: #3585891 Deprecate Validating CSRF tokens with the 'rest' key in CsrfRequestHeaderAccessCheck
• fix: #3597692 [regression] The 'dr' command doesn't set DRUPAL_TEST_IN_CHILD_SITE
• Revert "task: #3590050 Deprecate and replace locale_status related functions"