drupal 9.3.0-beta2

This is a beta release for the next minor (feature) release of Drupal 9. Betas are good testing targets for developers and site builders who are comfortable reporting (and where possible, fixing) their own bugs. Beta releases are not recommended for non-technical users, nor for production websites. More information on beta releases.

This release fixes security vulnerabilities present in Drupal 9.3.0-beta1. Sites are urged to update immediately after reading the security announcement and notes below:

• Drupal core - Critical - Third-party library - SA-CORE-2021-011

This minor release provides new improvements and functionality without breaking backward compatibility (BC) for public APIs. Note that there may be changes in internal APIs and experimental modules that require updates to contributed and custom modules and themes per Drupal core's backwards compatibility and experimental module policies.

Drupal 9.3.x contains new features, and should be the target for new site development. Drupal 9.2.x will continue to have security support until June 2022. Security support for 9.1.x ends with the release of 9.3.0 on December 8.

Important update information

Updating from Drupal 8

For information on updating from Drupal 8 to Drupal 9, see Upgrading a Drupal 8 site to Drupal 9.

Upgrading from Drupal 7

Drupal 6 and 7 users can continue to migrate to 9.3 directly. The migration paths from Drupal 6 and Drupal 7 to Drupal 9 will remain supported throughout Drupal 9's release cycle.

Dependency updates

• CKEditor 4 has been updated from 4.16.2 to 4.17.1 to address a security vulnerability.
• In preparation for the upcoming Symfony 5.4 release, Drupal's dependencies for symfony/phpunit-bridge, symfony/var-dumper, and symfony/mime have been updated from Symfony 5.3.0 to 5.4.0-beta2. These components will be updated to Symfony 5.4.0 prior to the release of Drupal 9.3.0.
• sebastian/exporter and laminas/laminas-stdlib have also received patch-level updates.

All changes since 9.3.0-beta1

• SA-CORE-2021-011 by jbogdanski, Wim Leers, xjm, greggles, lauriii, tedbow
• Issue #3056409 by rkostov, larowlan, maximpodorov: BlockRepository::contextHandler is created dynamically
• Issue #3248810 by daffie: [Symfony 6] The Drupal\Tests\jsonapi\Kernel\EventSubscriber\ResourceObjectNormalizerCacherTest fails with Symfony 5
• Issue #3248816 by bsuttis, danflanagan8, quietone: ResponsiveImageFieldUiTest.php should be moved to tests directory
• Issue #3248013 by daffie, longwave: [Symfony6] The Drupal\Tests\views\Unit\Pluginrgument_default\QueryParameterTest fails for Symfony 5.4
• Issue #3248809 by daffie, larowlan: [Symfony 6] The Drupal\Testsile\Kernel\FileItemValidationTest fails with Symfony 5
• Issue #3248801 by daffie, rakesh.gectcr, bbrala, longwave: [Symfony 6] The Drupal\Tests\jsonapi\Functional\JsonApiFunctionalTest fails with Symfony 5
• Issue #2707163 by quietone, chishah92, jhodgdon, AndrewHD, xjm, dww, jdelvillar01, alexpott: core/USAGE.TXT -- API section talks only about hooks and functions
• Issue #3249240 by alexpott, andypost, Wim Leers: HTMLRestrictionsUtilities:: providedElementsAttributes() causes deprecations on PHP 8.1
• Issue #3249233 by longwave: Update 9.3's Symfony 5 components to 5.4
• Issue #3249263 by alexpott, andypost, Wim Leers: CKEditor 5 needs validate the filters in the correct order - CKEditor 5 tests fail locally
• Issue #3231781 by longwave, mondrake, Feuerwagen, larowlan, TR, nlisgo, xxAlHixx, DuaelFr, GoZ, benjy, no_angel, Mac_Weber: [D9.3 beta - w/c Nov 8, 2021] Remove remaining uses of t() in tests
• Issue #3222769 by bbrala, alexpott, longwave, Matroskeen: [November 8, 2021] Replace all list (array destructuring) assignment to the array syntax
• Issue #3222251 by bbrala, longwave: [November 8, 2021] Replace all isset constructs with the null coalescing operator