drupal 9.2.0

This is a minor version (feature release) of Drupal 9 and is ready for use on production sites. Learn more about Drupal 9 and the Drupal core release cycle.

This minor release provides new improvements and functionality without breaking backward compatibility (BC) for public APIs. Note that there may be changes in internal APIs and experimental modules that require updates to contributed and custom modules and themes per Drupal core's backwards compatibility and experimental module policies.

Drupal 9.2.x contains new features, and should be the target for new site development. Drupal 9.1.x will continue to have security support until December 2021.

9.0.x will no longer receive security support, so sites on a Drupal 9.0.x version should upgrade to a supported release as soon as possible.

Drupal 8.9.x security coverage ends in November 2021, before Drupal 9.3.0 will be released, so if you are using Drupal 8, you must upgrade to Drupal 9.2 before November to keep your site secure.

Important update information

Updating from Drupal 8

For information on updating from Drupal 8 to Drupal 9, see Upgrading a Drupal 8 site to Drupal 9.

Sites on 8.7 or earlier must update to either 8.8 or 8.9 before updating to Drupal 9 as all Drupal 8 update functions from before Drupal 8.8.0-rc1 were removed from Drupal 9. We recommend updating to 8.9.x, as well as updating all contributed modules, before updating to any Drupal 9 release.

Note: The migration paths from Drupal 6 and Drupal 7 to Drupal 9 will remain supported throughout Drupal 9's release cycle.

Upgrading from Drupal 7

Drupal 7 users should migrate to 9.2 directly. The upgrade path for multilingual sites is stable in both Drupal 8 and 9.

Changes to site-owner-managed files

The web.config file used by Microsoft's IIS server has been updated to remove unnecessary configuration. The commented out Erase HTTP_PROXY rule has been removed. PHP 7.3 and up is not vulnerable and this rule can be removed if you have enabled it.

Other important update information

Changes to session generation and session ID handling

Drupal now uses PHPs built-in session generation. The change record details how custom and contributed code that relies on the session ID should be updated.

Changes to configuration file formats

Configuration files with multi-line strings formatting has changed

Configuration files with multi-line strings will be exported using Symfony's multi-line literal block formatting option, improving readability and diffs. This will mean a configuration diff the first time a configuration file is re-exported.

Dangerous file extension handling

If you limit allowed extensions and want dangerous files to be uploaded and renamed, you must explicitly allow txt file uploads. This is mandated when configuring file fields through the user interface.

Change to Views' default display name

Views renamed the default display from "Master" to "Default". This does not affect existing Views, only ones created after this change. Additionally, the setting to hide/show the default display had its machine name changed from ui.show.master_display to ui.show.default_display. Review the change record on the default display name change for more information.

README.txt replaced with README.md

Drupal's README now focuses on shepherding new contributors into the Drupal ecosystem and uses the Markdown format. The usage information previously contained in the README.txt file has been extracted to a newly created USAGE.txt file in the core directory. Sites that are using the drupal/core-composer-scaffold plugin to exclude README.txt should update their configuration to exclude README.md instead.

Permissions policy header

A Permissions-Policy header has been introduced, to block Google’s Federated Learning of Cohorts. See the change record for more information.

Dependency updates

Deprecated, changed, and removed dependencies

• The Goutte testing browser has been deprecated and replaced with a new mink driver client, using Guzzle. This should not require any changes to browser tests unless you are interacting with specific Goutte features. Review the change record on the Goutte driver replacement for more information.

• Drupal has replaced the behat/mink-browserkit-driver dependency with friends-of-behat/mink-browserkit-driver for PHP 8 and Symfony 5 compatibility.

• The tabbable library has been added to replace the functionality provided by for jQuery UI's :tabbable selector. A shim has been provided so all existing of uses of the :tabbable selector now use tabbable to query tabbable elements. See the change record for more information.

Added dependencies

• Drupal now uses Symfony's PHPUnit-Bridge polyfills for forward compatibility. This will allow developers to replace usages of deprecated assertions in preparation for PHPUnit 10. See the change record for more information.

• The core/once library, a standalone library that offers the same benefits as core/jquery.once but without the jQuery dependency, has been added to Drupal core.

• The projects psr/cache is added as a requirement dependency for doctrine/annotations.

Updated dependencies

CKEditor has been updated from 4.15.1 to 4.16.1, which includes numerous bugfixes and improvements.

The Sortable library has been updated to Sortable to 1.13.0

PHP dependency updates:

+--------------------------------------+---------+-----------+-------------------------------------------------------------------------------+
| Production Changes                   | From    | To        | Compare                                                                       |
+--------------------------------------+---------+-----------+-------------------------------------------------------------------------------+
| composer/installers                  | v1.9.0  | v1.10.0   | https://github.com/composer/installers/compare/v1.9.0...v1.10.0               |
| composer/semver                      | 3.2.2   | 3.2.4     | https://github.com/composer/semver/compare/3.2.2...3.2.4                      |
| doctrine/annotations                 | 1.11.1  | 1.12.1    | https://github.com/doctrine/annotations/compare/1.11.1...1.12.1               |
| drupal/core                          | 9.1.10  | 9.2.x-dev |                                                                               |
| drupal/core-project-message          | 9.1.10  | 9.2.x-dev |                                                                               |
| drupal/core-vendor-hardening         | 9.1.10  | 9.2.x-dev |                                                                               |
| egulias/email-validator              | 2.1.22  | 2.1.25    | https://github.com/egulias/EmailValidator/compare/2.1.22...2.1.25             |
| guzzlehttp/promises                  | 1.4.0   | 1.4.1     | https://github.com/guzzle/promises/compare/1.4.0...1.4.1                      |
| guzzlehttp/psr7                      | 1.7.0   | 1.8.1     | https://github.com/guzzle/psr7/compare/1.7.0...1.8.1                          |
| laminas/laminas-feed                 | 2.13.0  | 2.14.0    | https://github.com/laminas/laminas-feed/compare/2.13.0...2.14.0               |
| laminas/laminas-stdlib               | 3.3.0   | 3.3.1     | https://github.com/laminas/laminas-stdlib/compare/3.3.0...3.3.1               |
| laminas/laminas-zendframework-bridge | 1.1.1   | 1.2.0     | https://github.com/laminas/laminas-zendframework-bridge/compare/1.1.1...1.2.0 |
| pear/pear_exception                  | v1.0.1  | v1.0.2    | https://github.com/pear/PEAR_Exception/compare/v1.0.1...v1.0.2                |
| psr/container                        | 1.0.0   | 1.1.1     | https://github.com/php-fig/container/compare/1.0.0...1.1.1                    |
| symfony/console                      | v4.4.19 | v4.4.21   | https://github.com/symfony/console/compare/v4.4.19...v4.4.21                  |
| symfony/debug                        | v4.4.19 | v4.4.20   | https://github.com/symfony/debug/compare/v4.4.19...v4.4.20                    |
| symfony/dependency-injection         | v4.4.19 | v4.4.21   | https://github.com/symfony/dependency-injection/compare/v4.4.19...v4.4.21     |
| symfony/error-handler                | v4.4.19 | v4.4.21   | https://github.com/symfony/error-handler/compare/v4.4.19...v4.4.21            |
| symfony/event-dispatcher             | v4.4.19 | v4.4.20   | https://github.com/symfony/event-dispatcher/compare/v4.4.19...v4.4.20         |
| symfony/http-foundation              | v4.4.19 | v4.4.20   | https://github.com/symfony/http-foundation/compare/v4.4.19...v4.4.20          |
| symfony/http-kernel                  | v4.4.19 | v4.4.21   | https://github.com/symfony/http-kernel/compare/v4.4.19...v4.4.21              |
| symfony/mime                         | v5.1.11 | v5.2.6    | https://github.com/symfony/mime/compare/v5.1.11...v5.2.6                      |
| symfony/polyfill-ctype               | v1.20.0 | v1.22.1   | https://github.com/symfony/polyfill-ctype/compare/v1.20.0...v1.22.1           |
| symfony/polyfill-iconv               | v1.20.0 | v1.22.1   | https://github.com/symfony/polyfill-iconv/compare/v1.20.0...v1.22.1           |
| symfony/polyfill-intl-idn            | v1.20.0 | v1.22.1   | https://github.com/symfony/polyfill-intl-idn/compare/v1.20.0...v1.22.1        |
| symfony/polyfill-intl-normalizer     | v1.20.0 | v1.22.1   | https://github.com/symfony/polyfill-intl-normalizer/compare/v1.20.0...v1.22.1 |
| symfony/polyfill-mbstring            | v1.20.0 | v1.22.1   | https://github.com/symfony/polyfill-mbstring/compare/v1.20.0...v1.22.1        |
| symfony/polyfill-php80               | v1.20.0 | v1.22.1   | https://github.com/symfony/polyfill-php80/compare/v1.20.0...v1.22.1           |
| symfony/process                      | v4.4.19 | v4.4.20   | https://github.com/symfony/process/compare/v4.4.19...v4.4.20                  |
| symfony/psr-http-message-bridge      | v2.0.2  | v2.1.0    | https://github.com/symfony/psr-http-message-bridge/compare/v2.0.2...v2.1.0    |
| symfony/routing                      | v4.4.19 | v4.4.20   | https://github.com/symfony/routing/compare/v4.4.19...v4.4.20                  |
| symfony/serializer                   | v4.4.19 | v4.4.20   | https://github.com/symfony/serializer/compare/v4.4.19...v4.4.20               |
| symfony/translation                  | v4.4.19 | v4.4.21   | https://github.com/symfony/translation/compare/v4.4.19...v4.4.21              |
| symfony/validator                    | v4.4.19 | v4.4.21   | https://github.com/symfony/validator/compare/v4.4.19...v4.4.21                |
| symfony/var-dumper                   | v5.1.11 | v5.2.6    | https://github.com/symfony/var-dumper/compare/v5.1.11...v5.2.6                |
| symfony/yaml                         | v4.4.19 | v4.4.21   | https://github.com/symfony/yaml/compare/v4.4.19...v4.4.21                     |
| twig/twig                            | v2.14.1 | v2.14.4   | https://github.com/twigphp/Twig/compare/v2.14.1...v2.14.4                     |
| symfony/deprecation-contracts        | NEW     | v2.2.0    |                                                                               |
+--------------------------------------+---------+-----------+-------------------------------------------------------------------------------+

+-----------------------------------------+---------+---------+-------------------------------------------------------------------------------------+
| Dev Changes                             | From    | To      | Compare                                                                             |
+-----------------------------------------+---------+---------+-------------------------------------------------------------------------------------+
| behat/mink-browserkit-driver            | v1.3.4  | REMOVED |                                                                                     |
| composer/ca-bundle                      | 1.2.8   | 1.2.9   | https://github.com/composer/ca-bundle/compare/1.2.8...1.2.9                         |
| composer/spdx-licenses                  | 1.5.4   | 1.5.5   | https://github.com/composer/spdx-licenses/compare/1.5.4...1.5.5                     |
| composer/xdebug-handler                 | 1.4.4   | 1.4.6   | https://github.com/composer/xdebug-handler/compare/1.4.4...1.4.6                    |
| doctrine/instantiator                   | 1.3.1   | 1.4.0   | https://github.com/doctrine/instantiator/compare/1.3.1...1.4.0                      |
| drupal/coder                            | 8.3.10  | 8.3.12  | https://git.drupalcode.org/project/coder/compare/8.x-8.3....8.x-8.3.                |
| easyrdf/easyrdf                         | 1.0.0   | 1.1.1   | https://github.com/easyrdf/easyrdf/compare/1.0.0...1.1.1                            |
| myclabs/deep-copy                       | 1.10.1  | 1.10.2  | https://github.com/myclabs/DeepCopy/compare/1.10.1...1.10.2                         |
| phar-io/manifest                        | 1.0.3   | 2.0.1   | https://github.com/phar-io/manifest/compare/1.0.3...2.0.1                           |
| phar-io/version                         | 2.0.1   | 3.1.0   | https://github.com/phar-io/version/compare/2.0.1...3.1.0                            |
| phpspec/prophecy                        | 1.12.1  | 1.13.0  | https://github.com/phpspec/prophecy/compare/1.12.1...1.13.0                         |
| phpunit/php-code-coverage               | 7.0.10  | 7.0.14  | https://github.com/sebastianbergmann/php-code-coverage/compare/7.0.10...7.0.14      |
| phpunit/php-file-iterator               | 2.0.2   | 2.0.3   | https://github.com/sebastianbergmann/php-file-iterator/compare/2.0.2...2.0.3        |
| phpunit/php-timer                       | 2.1.2   | 2.1.3   | https://github.com/sebastianbergmann/php-timer/compare/2.1.2...2.1.3                |
| phpunit/php-token-stream                | 3.1.1   | 4.0.4   | https://github.com/sebastianbergmann/php-token-stream/compare/3.1.1...4.0.4         |
| phpunit/phpunit                         | 8.5.8   | 8.5.15  | https://github.com/sebastianbergmann/phpunit/compare/8.5.8...8.5.15                 |
| sebastian/code-unit-reverse-lookup      | 1.0.1   | 1.0.2   | https://github.com/sebastianbergmann/code-unit-reverse-lookup/compare/1.0.1...1.0.2 |
| sebastian/comparator                    | 3.0.2   | 3.0.3   | https://github.com/sebastianbergmann/comparator/compare/3.0.2...3.0.3               |
| sebastian/diff                          | 3.0.2   | 3.0.3   | https://github.com/sebastianbergmann/diff/compare/3.0.2...3.0.3                     |
| sebastian/environment                   | 4.2.3   | 4.2.4   | https://github.com/sebastianbergmann/environment/compare/4.2.3...4.2.4              |
| sebastian/exporter                      | 3.1.2   | 3.1.3   | https://github.com/sebastianbergmann/exporter/compare/3.1.2...3.1.3                 |
| sebastian/global-state                  | 3.0.0   | 3.0.1   | https://github.com/sebastianbergmann/global-state/compare/3.0.0...3.0.1             |
| sebastian/object-enumerator             | 3.0.3   | 3.0.4   | https://github.com/sebastianbergmann/object-enumerator/compare/3.0.3...3.0.4        |
| sebastian/object-reflector              | 1.1.1   | 1.1.2   | https://github.com/sebastianbergmann/object-reflector/compare/1.1.1...1.1.2         |
| sebastian/recursion-context             | 3.0.0   | 3.0.1   | https://github.com/sebastianbergmann/recursion-context/compare/3.0.0...3.0.1        |
| sebastian/resource-operations           | 2.0.1   | 2.0.2   | https://github.com/sebastianbergmann/resource-operations/compare/2.0.1...2.0.2      |
| sebastian/type                          | 1.1.3   | 1.1.4   | https://github.com/sebastianbergmann/type/compare/1.1.3...1.1.4                     |
| seld/jsonlint                           | 1.8.2   | 1.8.3   | https://github.com/Seldaek/jsonlint/compare/1.8.2...1.8.3                           |
| sirbrillig/phpcs-variable-analysis      | v2.9.0  | v2.11.0 | https://github.com/sirbrillig/phpcs-variable-analysis/compare/v2.9.0...v2.11.0      |
| symfony/browser-kit                     | v4.4.19 | v4.4.20 | https://github.com/symfony/browser-kit/compare/v4.4.19...v4.4.20                    |
| symfony/css-selector                    | v4.4.19 | v4.4.20 | https://github.com/symfony/css-selector/compare/v4.4.19...v4.4.20                   |
| symfony/dom-crawler                     | v4.4.19 | v4.4.20 | https://github.com/symfony/dom-crawler/compare/v4.4.19...v4.4.20                    |
| symfony/filesystem                      | v4.4.19 | v4.4.21 | https://github.com/symfony/filesystem/compare/v4.4.19...v4.4.21                     |
| symfony/finder                          | v4.4.19 | v4.4.20 | https://github.com/symfony/finder/compare/v4.4.19...v4.4.20                         |
| symfony/lock                            | v4.4.19 | v4.4.21 | https://github.com/symfony/lock/compare/v4.4.19...v4.4.21                           |
| symfony/phpunit-bridge                  | v5.1.11 | v5.2.6  | https://github.com/symfony/phpunit-bridge/compare/v5.1.11...v5.2.6                  |
| webmozart/assert                        | 1.9.1   | 1.10.0  | https://github.com/webmozarts/assert/compare/1.9.1...1.10.0                         |
| friends-of-behat/mink-browserkit-driver | NEW     | v1.5.0  |                                                                                     |
+-----------------------------------------+---------+---------+-------------------------------------------------------------------------------------+

Changes to coding standards

The following coding standards checks have been enabled in core:

Drupal.Semantics.RemoteAddress
Drupal.Classes.PropertyDeclaration
Drupal.Commenting.DocComment.ParamGroup
Generic.Formatting.DisallowMultipleStatements
Squiz.WhiteSpace.ScopeKeywordSpacing
Drupal.Commenting.DocCommentAlignment
Drupal.Commenting.FunctionComment.ParamMissingDefinition
Drupal.Commenting.FunctionComment.InvalidTypeHint
Drupal.Commenting.FunctionComment.IncorrectTypeHint
Drupal.Commenting.HookComment
Drupal.Classes.UseGlobalClass
Drupal.Commenting.DocComment.TagGroupSpacing
Drupal.Commenting.DocComment.ShortFullStop

Known issues

Users of redirect_after_login module may experience issues after updating to 9.2.0, this is being resolved in an issue against that module.

Search the issue queue for known issues.

Changes since 9.2.0-rc1

Changes since 9.2.0-rc1:

• #3177415 by ramil g, joelpittet, jplana, kishor_kolekar: Vertical Tabs CSS classes applying to non-vertical tab detail element groups
• #3214395 by YesCT, paulocs: Add ModuleUninstallValidatorInterface hint to hook_uninstall docs
• #3064596 by neclimdul, quietone: Avoid format calls in DateTimePlus::createFromFormat
• #3217357 by Anandhi K, jungle, Rinku Jacob 13, longwave: Replace occurrences of outdated text "Extending Drupal 8" and its link
• #3092553 by amateescu, dixon_, shaal, xjm, ckrina, jrockowitz, webchick, worldlinemine: Add a row for switching to the live workspace in the Workspaces listing UI
• #3217861 by jhodgdon: Documentation needed in ConfigEntityDependency::getDependencies() to explain what the $type == module code is doing
• #3218658 by nod_: Update @drupal/once to 1.0.1
• #3187318 by sudiptadas19, eddie_c, huzooka, anmolgoyal74, quietone, Wim Leers, alexpott: ContentEntity source plugin should exclude user with uid "0"
• #3216552 by andypost, mondrake, Gauravmahlawat, daffie, joachim: Incorrect calls to Connection::select() in MenuTreeStorage
• #3215611 by alexpott, longwave: Service deprecations are only triggered on container build,not ::get()
• #2359675 by Grimreaper, jhedstrom, paulocs, anrikun, Lendude, larowlan, nicoloye, dww, alexpott: File field's Maximum upload size always passes validation
• #2716019 by joseph.olstad, rodrigoaguilera, _Archy_, Lendude, mdupont, anmolgoyal74, mpp, Krzysztof Domański, DamienMcKenna, adityasingh, Skymen, benelori, Suresh Prabhu Parkala, rensingh99, alexpott, paulocs, HeyJo, iiRealXz, dawehner, xjm, 5n00py, tstoeckler, Karsa, dbyers55, idebr: View titles in breadcrumb and metatag title don't get properly translated
• #3217706 by Spokje, longwave, guilhermevp, mondrake: Replace usages of assertFileNotExists(), that is deprecated
• #3218586 by mondrake: Missed one conversion to expectWarning()
• #3215198 by phma: Thumbnail updates read width and height from source image on save even if queued
• #3217732 by bnjmnm, Wim Leers: filterStatus behavior can't find settings markup after AJAX update
• #3217714 by mondrake, ravi.shankar, guilhermevp, longwave: Replace usages of expectException(Warning::class), that is deprecated
• #3218139 by gapple, longwave: Stop altering existing Permissions-Policy header in FinishResponseSubscriber
• #3012172 by acbramley: EntityViewBuilder::addContextualLinks assumes an entity's canonical rel is routed/internal
• #3217716 by sudiptadas19, Meenakshi_j, hmendes, guilhermevp, mondrake: Replace usages of expectException(Error::class), that is deprecated
• #3116804 by dww, tedbow, benjifisher, heddn, xjm, jungle: Add tedbow and dww as maintainers for Update Manager
• #3213616 by n4r3n, Wim Leers, quietone: Map all Datetime module's field formatters from D6/D7 to D8/D9
• #3134554 by Matroskeen, larowlan, paulocs, aluzzardi, phenaproxima, mark_fullmer, vierlex, hchonov, grathbone: Media fields with Media Library form widget trigger PHP 'Notice: Undefined index'
• #3218024 by Charlie ChX Negyesi, longwave, Berdir: Field called "link" breaks the RSS Views plugins
• #3217713 by guilhermevp, vsujeetkumar, mondrake, sudiptadas19, vikashsoni: Replace usages of assertFileNotIsWritable(), that is deprecated
• #2977495 by alexfarr, Sam152, Neslee Canil Pinto, timmillwood, alexpott: Content Moderation missing permission descriptions
• #3210898 by quietone, BhumikaVarshney: Combine tests using NormalizerDenormalizeExceptionsUnitTestBase
• #3084436 by longwave, simonminter, Spokje, alexpott, alisonjo315, pameeela, webel: Config export field should be cleared when config type changes
• #3214773 by jmsosso, Spokje: Wrong type hint for getActiveMultiple() and getCanonicalMultiple() in EntityRepositoryInterface
• #3217711 by Spokje, sudiptadas19, guilhermevp, mondrake: Replace usages of assertNotRegExp(), that is deprecated
• #3174200 by mondrake, longwave, alexpott: Use PHPUnit-bridge polyfills for forward compatibility layer
• #3217712 by sudiptadas19, mondrake: Replace usages of assertDirectoryNotIsWritable(), that is deprecated
• #3217709 by sudiptadas19, mondrake: Replace usages of assertRegExp(), that is deprecated
• #3122056 by Wim Leers, mohit_aghera, Kristen Pol: Do not track viewing history for unsaved entities, nor when previewing existing entities
• #3214487 by paulocs, vakulrai, vetal4ik, manojithape, nishantghetiya, quietone, Lendude: Remove 'reply' link from comment field when threading is disabled