drupal 9.0.5

This is a patch (bugfix) release of Drupal 9 and is ready for use on production sites. Learn more about Drupal 9.

Drupal 9.0.x will receive security coverage until June 2, 2021 when Drupal 9.2.0 is released.

If you are upgrading from Drupal 8, read upgrading a Drupal 8 site to Drupal 9 and the 9.0.0 release notes before upgrading to this release.

If your site is on 8.8.x or earlier, you may wish to upgrade to Drupal 8.9.3 instead, and upgrade to Drupal 9 at a later date after preparing your site.

Important update information

This release provides hotfixes for two issues:

• Yesterday, Symfony issued a security advisory for their symfony/http-client component, which is not used by Drupal. The Symfony release also updated some compatibility code in the symfony/http-kernel component.

  Although Drupal is not affected by this vulnerability, some site owners reported automated security scanners flagging the http-kernel update as a security update, breaking continuous integration builds, etc. For simplicity, this release updates Drupal's metapackages to use the latest release of symfony/http-kernel (version 4.4.13).

• A regression in Drupal 9.0.4 and 8.9.4 caused Paragraphs modal dialogs to not be displayed correctly due to a CSS change in core. The issue that introduced this change has been reverted (#3070375: Hidden buttons in off-canvas dialog are not being hidden) so Paragraphs should again work as expected.

Known issues

Search the issue queue for known issues.

All changes since Drupal 9.0.4

• Issue #3168763 by xjm, suzymasri, longwave: Update Symfony to 4.4.13 to address CVE-2020-15094
• Revert "Issue #3070375 by lauriii, sacarney: Hidden buttons in off-canvas dialog are not being hidden"