drupal 9.0.6

Maintenance and security release of the Drupal 9 series.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the notes below and the security announcement:

• Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007
• Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008
• Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009
• Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010
• Drupal core - Moderately critical - Information disclosure - SA-CORE-2020-011

No other fixes are included.

Which release do I choose? Security coverage information

• Drupal 9.0.x will receive security coverage until June 2, 2021 when Drupal 9.2.0 is released.
• Sites on 8.9.x should update immediately to Drupal 8.9.6 instead.
• Sites on 8.8.x or earlier should update immediately to Drupal 8.8.10 instead, and plan to update to the latest 8.9.x or 9.0.x release before December 2, 2020 (when Drupal 9.1.0 is scheduled for release and 8.8.x security coverage ends).
• Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage.

Important update information

• Once a site running Workspaces is upgraded for SA-CORE-2020-008, authenticated users may continue to see unauthorized workspace content that they accessed previously until they are logged out.

  If it is important for the unintended access to stop immediately, you may wish to end all active user sessions on your site (for example, by truncating the sessions table). Be aware that this will immediately log all users out and can cause side effects like lost user input.

• Sites that override \Drupal\Core\Form\FormBuilder's renderPlaceholderFormAction() and/or buildFormAction() methods in contrib and/or custom code should ensure that appropriate sanitization is applied for URLs for SA-CORE-2020-009.

• Any site that relies on Drupal's AJAX API to perform trusted JSONP requests will need to either override the AJAX options to set "jsonp: true" or use the jQuery AJAX API directly.

  If you are using jQuery's AJAX API for user-provided URLs in a contrib or custom module, you should review your code and set "jsonp: false" where this is appropriate.

• No changes have been made to the .htaccess, web.config, robots.txt, or default settings.php files in this release, so upgrading custom versions of those files is not necessary if your site is already on the previous release.

Known issues

• #3171480: File upload broken in some cases for anonymous users after SA-CORE-2020-011