Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Install
To start a new Drupal project with version 9.0.2:To update your site and all dependencies to the latest version of Drupal:
To update your site to this specific release:
Pinning to a specific release may make it more challenging to update your site in future, see composer documentation for managing pinned versions
Using Composer to manage Drupal site dependencies
Downloads
Download tar.gz
16.06 MB
MD5: 76387b060f09ddc8359a533f3f8d1f8d
SHA-1: e382d4abb06519d18639516fbfab43c2a78ab22c
SHA-256: eae4c9cb638aff2a07c104d0a988f7ba78c980ba6e31bedaddd00baa5c19946a
Download zip
26.98 MB
MD5: 008cdf1e0ff4fbcf3225a0e1e6de4fef
SHA-1: f8ce79d3192e41a1a42e7e799fca14652c88bf3c
SHA-256: 2c420f84a2720ef44111e1815d232785e7d6868baa320d027ceed001ea09b5db
Release notes
This is a patch (bugfix) release of Drupal 9 and is ready for use on production sites. Learn more about Drupal 9.
Drupal 9.0.x will receive security coverage until June 2, 2021 when Drupal 9.2.0 is released.
If you are upgrading from Drupal 8, read upgrading a Drupal 8 site to Drupal 9 and the 9.0.0 release notes before upgrading to this release.
If your site is on 8.8.x or earlier, you may wish to upgrade to Drupal 8.9.2 instead, and upgrade to Drupal 9 at a later date after preparing your site.
Known issues
Search the issue queue for known issues.
All changes since Drupal 9.0.1
- Issue #2914785 by acbramley, jungle, Hardik_Patel_12, mrinalini9: Entities with external urls as a uri relationship can not be deleted when menu_link_content is installed
- Issue #3149930 by Lendude, ravi.shankar, Bobík, dww, joaomachado, alexpott, lauriii: Views table settings exposes "Details" field even when empty
- Issue #3152003 by Beakerboy, sanjayk, alexpott, daffie: EndOfTransactionQueriesTest does not include bootstrap.inc early enough for contrib database drivers
- Issue #3027763 by quietone, LiamPower, pratik_kamble: UnroutedUrlAssembler removes query params array item key in buildExternalUrl()
- Issue #3144046 by Matroskeen: Incorrect example of adding Cache metadata in hook_menu_local_tasks_alter()
- Issue #3144354 by alexpott, vijaycs85, andypost: ModuleInstaller loads .module and .install before allowing classes to autoloaded
- Issue #2834525 by alexpott, kim.pepper, jummonk, joshua.roberson, Ruuds: Permission denied caused by race condition during ensureDirectory should be silenced
- Issue #3151520 by adityasingh, pavnish, daffie, alexpott: Replace the database query with an entity query in UserInstallTest
- Issue #2120877 by quietone, BryanGullan, duellj, jibran, miro_dietiker, dags: Add tests for tracker module's Tools menu link
- Issue #2898947 by rajandro, jungle, ankit.singh, AkashkumarOSL, Lal_, shimpy, Saurabh_sgh, markdorison, gnikolovski, jordanwood, librarylasso, Swapnil_Kotwal, mrinalini9, chiranjeeb2410, codersukanta, daffie, xjm, alexpott, mmjvb, mparker17, MaskyS, larowlan, quietone: Change "writeable" to "writable" in documentation
- Issue #3145930 by bnjmnm, msuthars, nod_: Tableheader should recalculate on toolbar tray toggle
- Issue #3154461 by Hardik_Patel_12: Removing getFormObject call from UserAccountFormFieldsTest
- Issue #3151047 by quietone, jibran, larowlan, xjm, pameeela: Expand LinkWidget test coverage
- Issue #3116147 by idebr, tim.plunkett: Remove @todo pertaining to RequestHelper::duplicate(), which has been removed
- Issue #3138796 by jungle, mohrerao, sja112, kkalashnikov, xjm, ketikagrover: Fix the typos "cotrol" and make the one-line summaries containing it conform to standards)
- Issue #3154611 by jungle, xjm, longwave: Update composer.lock for 9.0.x and 8.9.x based on Composer 1.10 availability
- Issue #3146474 by shaktik, kiamlaluno: Remove Unused variable $next from AggregatorController.php file
- Issue #3154533 by jperk224, jungle: Fix "Drupal" typos in core
- Issue #3153869 by jungle: Remove leftover of wikimedia/composer-merge-plugin
- Issue #3028621 by jungle, John Cook: BatchBuilder included files fails
- Issue #2904467 by quietone, andyg5000: Plugins do not preserve integer keys when parsing annotations
- Issue #3149799 by mxr576, jungle: BasicAuth::authenticate() does not respect the implemented interface
- Issue #3154203 by jungle: Fix "appear" typos in core
- Issue #3150731 by andypost, Beakerboy, kim.pepper: FileSystemModuleDiscoveryDataProviderTrait needs to use DIRECTORY_SEPARATOR
- Issue #3138788 by jungle, sja112, xjm: Fix "autcomplete" typos in core
- Issue #3138791 by jungle, sja112, xjm, mohrerao: Fix "bubbleable" relevant typos in core
- Issue #3153722 by Hardik_Patel_12: Make $modules property protected on DuplicateContextualLinksTest, NoMultilingualReviewPageTest and MenuActiveTrail403Test
- Issue #3143316 by Lendude, sunset_bill, daffie, xjm, facine: "Getting the base fields is not supported for entity type" exception in ViewsConfigUpdater
- Issue #3150471 by durgeshs, joachim: incorrect constant in docs for DoTrustedCallbackTrait::doTrustedCallback()
- Issue #3151091 by dww, rik-dev, alexpott: Replace use of whitelist/blacklist in \Drupal\Component\Utility\Xss and its test and core/lib/Drupal/Core/Render/theme.api.php
- Issue #3097540 by imganesh, boulaffasae, antoineh, sauravk, KondratievaS, atul4drupal, lauriii, Neetika K, Devipriya Rajamanickam: The 'M' of Machine name overlaps with the green border around text box
- Issue #3133033 by munish.kumar, xjm, Hardik_Patel_12, daffie, swatichouhan012: Fix Drupal.Array.Array.LongLineDeclaration coding standard for instances of the drupalCreateUser() test method
- Issue #3143482 by atul4drupal, nitvirus: Replace README.txt links that have a redirect with the preferred URL (including removing stale references to Drupal 8 docs)
- Issue #3143196 by DevJoJodae, himanshu_sindhwani, nitvirus, alexpott, sykesjs, jungle: Change the download link in CHANGELOG.txt to Drupal 9
- Issue #3144331 by mohrerao, longwave, daffie: Update comment in Drupal\Tests\RandomGeneratorTrait::randomStringValidate()
- Issue #3135305 by longwave: Remove Symfony 4.1 compatibility layer from EmailConstraint
- Issue #3072305 by jungle, andypost, thursday_bw, longwave, larowlan: Notice: Undefined index: #item in user_user_view_alter()
- Back to dev.
- Merged 9.0.1.
- Issue #3139414 by cburschka, mohrerao, pavnish, jungle, ravi.shankar, daffie, mondrake, sja112: Replace usages of deprecated AssertLegacyTrait::assert(No)Link()
- Issue #3150474 by jungle, munish.kumar: Inaccurate return type of \Drupal\views\Views::getView()
- Issue #3139402 by mondrake, sja112, xjm: Replace usages of AssertLegacyTrait::assertIdenticalObject(), which is deprecated
- Issue #2673688 by himanshu_sindhwani, kkalashnikov, atul4drupal, Saurabh_sgh, walangitan, andypost, markdorison, Bunty Badgujar, xjm, catch: Remove remains of hook_field_schema()
- Issue #3135077 by mondrake, sja112, daffie, longwave, xjm: Remove usage of AssertLegacyTrait::pass() from traits
- Issue #2947588 by mrinalini9, borisson_, shaktik, andypost, daffie, joachim, Lendude: Refactor \Drupal\Tests\views\Kernel\ModuleTest::testViewsGetHandler
- Issue #3143173 by martin107, andypost, longwave: Followup: ProxyBuilder compatibility with Symfony 5 - needs to handle voids correctly
- Issue #3150661 by cburschka: FileFieldRSSContentTest uses XPath incorrectly
- Issue #3142752 by sja112, mondrake, xjm, longwave: AssertLegacyTrait::assert(No)Escaped() in functional tests still have a message passed in
- Issue #3137430 by TR, jungle, alexpott: label_collection is defined twice in BlockContentType entity annotation
- Issue #3139422 by sja112, jungle, akanksha-hp, mondrake, xjm: Replace usages of deprecated AssertLegacyTrait::assertOptionByText()
- Issue #3139132 by Beakerboy, daffie: Query uses hardcoded LIMIT instead of queryRange()
- Issue #3151087 by rik-dev, dww, alexpott, Matroskeen: Replace use of whitelist/blacklist in file_munge_filename() and its tests
- Issue #2946750 by Sam152, merauluka, timmillwood, catch: Node revisions forced even if bundle not under moderation workflow
- Issue #3020387 by Sam152, luisnicg, bahuma20, jungle: Moderation state is the same for all node's translations in edit page
- Issue #3150990 by cburschka: Updater::install() crashes on file transfer exceptions
- Issue #3023311 by bnjmnm, huzooka, kostyashupenko, boulaffasae, nod_, mrinalini9, codersukanta, lauriii, fhaeberle, ckrina, Peter Majmesku, andrewmacpherson, saschaeggi, antonellasevero, DyanneNova, thekishanraval: Modal dialog style update
- Issue #3127918 by jungle, longwave: Add funding info in composer.lock
- Issue #3016427 by sysosmaster, nod_, kkalashnikov, Neslee Canil Pinto, alexpott, quicksketch: Default timezone selection incorrect
- Issue #3146567 by alexpott, pacproduct: Wrong key name in "Missing required key (base_theme)" exception message
- Issue #3143604 by chr.fritsch, Taran2L, longwave, alexpott, dungahk: PhpUnitCompatibility\PhpUnit8\ClassWriter cannot detect PHPUnit source directory when running PHPStan check
What’s next?
- Learn how to install Drupal
- Learn how to update Drupal
- Extend Drupal to do more
- Get training
- Check out what others built
Bug fixes
Insecure
