Try a hosted Drupal demo

Install

To start a new Drupal project with version 9.4.0:

To update your site and all dependencies to the latest version of Drupal:

To update your site to this specific release:
Pinning to a specific release may make it more challenging to update your site in future, see composer documentation for managing pinned versions

Using Composer to manage Drupal site dependencies

Downloads

Download tar.gz 20.47 MB
MD5: 7a8d5b7f0cab063bac3a668c2740daf3
SHA-1: df2854e7f2b27eb31afb0d8574daf04da9a21b5b
SHA-256: 66b918a6cbdeae10f6d9ac4b69cec0a9cbec2a6edf5c1d475aa9278016d370cf
Download zip 32.88 MB
MD5: 51ddfd0c82129d654bfd26ecfc257c7f
SHA-1: 0beb55e11ef55772926849ef47f420d22d5777fd
SHA-256: 9ed86ba4b30db88a9d1cacbec2ebe61cbb5566894b61d8334d570a1c0726e9a7

Release notes

This is a minor version (feature release) of Drupal 9 and is ready for use on production sites. Learn more about Drupal 9 and the Drupal core release cycle.

This minor release provides new improvements and functionality without breaking backward compatibility (BC) for public APIs. Note that there may be changes in internal APIs and experimental modules that require updates to contributed and custom modules and themes per Drupal core's backward compatibility and experimental module policies.

Minor releases may include string changes and additions. Translators can review the latest translation status on localize.drupal.org.

Drupal 9.4.x contains new features, and should be the target for new site development. Drupal 9.3.x will continue to have security support until December 2022.

9.2.x and 8.9.x will no longer receive security support, so sites on a Drupal 8 or 9 version earlier than 9.2.x should upgrade to a supported release as soon as possible.

Important update information

Updating from Drupal 8

For information on updating from Drupal 8 to Drupal 9, see Upgrading a Drupal 8 site to Drupal 9.

Upgrading from Drupal 6 and 7

Drupal 6 and 7 users can continue to migrate to Drupal 9.4 directly. The migration paths from Drupal 6 and Drupal 7 to Drupal 9 will remain supported throughout Drupal 9's release cycle.

Changes to site-owner-managed files

  • The root .htaccess file now has a section for PHP 8 settings. This brings .htaccess files into alignment with Drupal’s supported PHP version.

    If you have a custom .htaccess file and its PHP settings are working, you can keep using your existing .htaccess file unchanged. If you are upgrading from PHP 7 to PHP 8, adopt the new .htaccess file and adopt the custom settings that you need from your existing .htaccess file PHP 7 section to the new PHP 8 section.

  • The theme used when update.php is run and there is no maintenance_theme selected in settings.php has changed:

    1. If Claro is installed, it will be used as the maintenance theme.
    2. If Seven is installed and Claro is not, Seven will be used as the maintenance theme.
    3. If neither Claro nor Seven are installed, the default theme is used.

    Review the change record on the maintenance theme changes for more information.

Platform requirements changes

Minimum supported PHP version increased to PHP 7.4; PHP 8.1 recommended

Drupal 9.4's minimum PHP requirement has been increased from PHP 7.3 to 7.4. Sites on PHP 7.3 may still be installed and updated (with a warning), but their security coverage is not guaranteed unless they update to at least PHP 7.4. For more information, see the PHP requirements handbook page.

PHP 8.1 is now the recommended PHP version to use with Drupal 9.4 and above.

Database drivers moved to their own modules

The core supported database drivers, MySQL, PostgreSQL and SQLite, have been moved to their own modules. The modules are installed when the 9.4.0 update is run. Code that uses core-supplied database classes will continue to work, but these classes are deprecated and will be removed in Drupal 11. Custom and contrib drivers will need to supply a module parameter when encoding database connections as URLs.

See the known issues for known bugs related to this change.

Database JSON support warning

Drupal core will begin warning in the status report if a database connection doesn't support JSON, in preparation for this becoming an installation requirement in Drupal 10. The most common MySQL/MariaDB/Percona databases used with Drupal already had this requirement for Drupal 9.0, so this new warning is likely to appear only for SQLite and PostgreSQL users.

The drupal/core-recommended metapackage now allows patch-level updates for dependencies. This means that site owners using drupal/core-recommended can now install most Composer dependency security updates themselves, without needing to wait for an upstream release of Drupal core that updates the affected package. Site owners should test patch-level updates before deploying them. Instructions for managing dependency updates with the updated drupal/core-recommended metapackage.

Note that egulias/email-validator has a wider constraint due to the name of its most recent supported version, so site owners may wish to add a specific constraint to avoid updates to version 3.3 or higher in the future.

The CKEditor 5 experimental module is nearly (but not quite) stable

CKEditor 4 will be end-of-life in 2023. The CKEditor 5 experimental module will replace CKEditor 4 in Drupal 10. CKEditor 5 differs significantly from CKEditor 4, so we strongly recommend sites and modules begin testing with it now in preparation for Drupal 10's release later this year. Only a few issues remain until the new module can be marked stable, including a critical data loss bug for custom tags when using Full HTML text format, support for inserting externally hosted images, support for Styles Combo (which blocks some contributed projects), and a number of accessibility issues. Most of these are blocked on upstream improvements, and we're working closely with the CKEditor team!

Testing CKEditor 5

Back up your site data and configuration before beginning testing.

  1. The automatic content upgrade path: Under Configuration > Content Authoring > Text formats and editors, configure a text format and change its "text editor" setting from "CKEditor" to "CKEditor 5". (This will happen automatically when upgrading to Drupal 10.)

    You will get the equivalent CKEditor 5 configuration created automatically: toolbar, plugin settings, and so on. Messages will appear upon switching that explain what happened and why. Verify that the messages and generated configuration are correct.

  2. The editing experience: Verify that the default CKEditor 5 configuration works as you need and expect. For example, the linking experience should be improved, uploading images is much faster, and so on.

  3. Your existing content: When you edit existing content with CKEditor 5 and you save it, verify that the resulting markup looks as you expect, and that no data is lost.

Upgrading contributed modules to CKEditor 5

The module can be also used for making modules extending CKEditor 4 to become compatible with CKEditor 5.

Deprecated modules

The following core modules are deprecated in Drupal 9.4 and will be moved to contributed projects in Drupal 10:

  • Color
  • Aggregator
  • HAL
  • The Entity Reference and SimpleTest stubs

Sites will receive warning messages when deprecated modules are in use. Review the deprecated module documentation on the steps to take if your site uses any of these modules.

API changes

Changes to the Standard and Umami Demo profiles

  • The Standard profile now uses Olivero as a frontend theme instead of Bartik, and both Standard and the Umami Demo profile use Claro instead of Seven for the administrative theme. The default configurations for Bartik and Seven have been moved to the optional configuration. Standard and Umami now install with default configuration for Olivero and Claro according to core standards.

    This change does not affect existing sites, but does affect new site installation where the new themes will be the defaults.

  • Standard profile will no longer enable the Color module when installed.

Backend dependency updates

The following dependencies have been changed or updated since 9.3.

  • Sites are able to install Guzzle 7 due to a widening of Drupal core's composer constraints. This allows for more complete PHP 8.1 support. Contributed modules should continue to provide Guzzle 6 support since both the drupal/core-recommended package and tarballs continue to provide Guzzle 6.

    • Site owners who are using drupal/core-recommended and wish to use Guzzle 7 will need to change their site to depend on drupal/core directly. Note that your Composer dependencies will no longer be locked to specific patch or minor release versions after this change, so you will need to take care to avoid accidentally updating dependencies before your site is ready.

      Test thoroughly before deploying an update to Guzzle 7, as some contributed and custom projects may be incompatible with it.

    • Site owners who do not use drupal/core-recommended should take care to ensure they do not accidentally update to Guzzle 7 when running composer updates. Review the instructions for managing Guzzle updates without drupal/core-recommended.

  • Drupal 10 will switch its PSR-17 implementation from laminas/laminas-diactoros to Guzzle. It should not be necessary to make any changes unless you are directly referencing Diactoros classes. If your project does depend directly on any Diactoros code (uncommon), you should make sure it is declared as a dependency in your composer.json or change the code to use Guzzle.

  • Drupal core's pinned Composer dependency versions have been updated for the latest minor and patch releases.

    Additionally, Drupal core’s composer constraints have been increased to require the latest minor version for forward compatibility. This ensures that if any composer package that Drupal core depends upon has a security release, the Drupal core security update will be non-disruptive, because if possible no minor version increase will occur for the affected dependency, only a patch version increase.

Backend development dependencies

  • Coder has been updated to 8.3.15. This version will automatically set up Drupal coding standards sniffs in PHP_CodeSniffer thanks to a new dependency on dealerdirect/phpcodesniffer-composer-installer.

Frontend dependency updates

Frontend production dependencies

  • The Backbone and Underscore core JavaScript dependencies are deprecated and will no longer be provided as public core libraries in Drupal 10. Consequently, the drupal.editor.admin and drupal.filter.filter_html.admin libraries no longer depend on Underscore. Backbone and Underscore will eventually be removed from core, possibly prior to Drupal 10.0.0.

    Modules or themes which depend on these libraries should either refactor their code to remove the dependencies, or treat them as third-party dependencies for the contributed module.

    Most Underscore functionality has simple replacements in modern ES6 JavaScript. Review the change record about the Underscore deprecation for more information on upgrading your code.

    Both these deprecated dependencies have also received patch-level updates: Backbone has been updated from 1.4.0 to 1.4.1, and Underscore has been updated from 1.13.2 to 1.13.3.

  • Drupal 10 will drop support for Internet Explorer 11. This includes removing all polyfills in Drupal 10. If you plan to continue supporting Internet Explorer 11 even when used with Drupal 10, your project will have to depend on any required polyfills directly. If you plan to support Internet Explorer 11 only until the end-of-life of Drupal 9, you don’t have to do anything until Drupal 9 is end-of-life.

    For a full list of polyfills being removed, reference the draft Drupal 10 change records for removing Internet Explorer 11 polyfills and removing Drupal's custom <details> fieldset collapse script.

  • The latest minor versions of all JavaScript dependencies are now required by core yarn constraints. Additionally, the constraints have been changed to only allow patch-level updates for production dependencies. This allows yarn upgrades to be done easily and safely when there are security issues with the dependencies, without accidentally making disruptive updates to production dependencies.

    The constraints will be deliberately increased as necessary for future updates and future Drupal minor versions.

  • Shepherd.js has been updated from 8.3.1 to 9.1.0. According to its release note, there should be no breaking changes that affect our usage.

  • SortableJS has been updated from 1.14.0 to 1.15.0. According to its release note, there should be no breaking changes that affect our usage.

  • tabbable has been updated from 5.2.1 to 5.3.2. According to its release note, there should be no breaking changes that affect our usage.

  • Popper.js has been updated from 2.11.2 to 2.11.5.

Frontend development dependencies

  • Node.js is a development dependency for Drupal core. In Drupal 9 and 10, Drupal core's Node.js requirement has been updated from 12.0.0 to 16.0.0. (Information on changes in Node.js 16.) An updated version of Node.js can be installed directly or with nvm. This only affects sites that have installed Drupal core's JavaScript development dependencies with npm or yarn.

  • The Chromedriver JavaScript development dependency has been updated from 87.0.0 to 98.0.1.

  • Eslint has been updated from 7.32.0 to 8.9.0. core/.eslintrc.passing.json has been updated to reflect the new rules.

  • Stylelint has been updated from 13.13.1 to 14.8.2, and minor changes have been made to whitespace and quoting in core CSS. Refer to the change record on the Stylelint 14 update for more information.

  • The jsdom development dependency has been updated from 18.1.1 to 19.0.0.

  • All of Drupal core’s JavaScript development dependencies have been updated to the latest allowed minor and patch versions to address security issues in those dependencies. This should have minimal impact on contributed or custom code and CI workflows. Core developers should completely remove their core/node_modules directory and re-run yarn install from within the core/ directory.

Changed coding standards

  • JavaScript linting now uses eslint-config-airbnb-base instead of eslint-config-airbnb for linting core JavaScript. Anyone who uses core’s ESLint config to lint React or JSX code should add eslint-config-airbnb back to their yarn dev dependencies.

Known issues

Search the issue queue for known issues.

All changes since Drupal 9.4.0-rc2

What’s next?

  1. Learn how to install Drupal
  2. Learn how to update Drupal
  3. Extend Drupal to do more
  4. Get training
  5. Check out what others built
Created by: xjm
Created on: 15 Jun 2022 at 16:35 UTC
Last updated: 14 Apr 2023 at 12:42 UTC
Git tag 9.4.0
Insecure
Bug fixes
New features
Unsupported

Other releases