drupal 9.4.4

This is a patch (bugfix) release of Drupal 9 and is ready for use on production sites. Learn more about Drupal 9.

Drupal core uses the third-party Diactoros library as its PSR-7 implementation. Diactoros has issued a security advisory:

• CVE-2022-31109: Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack

Drupal core is unlikely to be vulnerable. This bugfix release updates the version of Diactoros used in drupal/core-recommended to a secure version as a precaution. As a reminder, Drupal 9.4 and higher sites should update their third-party Composer dependencies when an upstream security advisory is issued.

Drupal 9.4.x will receive security coverage until June 2023.

If you are upgrading from Drupal 8, read upgrading a Drupal 8 site to Drupal 9, 9.0.0 release notes, and the 9.4.0 release notes before upgrading to this release.

Important update information

• Drupal no longer specifies core modules in the 'replace' section of composer.json. This allows contributed versions of core modules to be downloaded with the canonical namespace using Composer.

• Following the development of Drupal 9.4.0, we have discovered PHP versions 8.1.0-8.1.5 have a bug with the PHP OPcache that may cause intermittent fatal errors at runtime for class autoloading. Since PHP 8.1.6 is recent it may not yet be available on hosting platforms, the minimum recommended PHP version for Drupal 9.4 has been lowered to 8.0. PHP 8.1.6 or higher is still the best choice for forward-compatibility with Drupal 10.

• Previously, plugin settings for all CKEditor plugins were stored in the editor configuration. This included disabled plugins.

  To keep the editor configuration in a consistent state, plugin settings are now only stored for CKEditor plugins that are enabled. Stored editor configuration entities will be updated in this release to remove the disabled plugin data.

  To ensure CKEditor data is upgraded to CKEditor 5 correctly, sites should update to this release prior to updating to Drupal 10.

• The CKEditor 4 to 5 upgrade path no longer checks if a plugin is enabled before migrating its config. Sites should update to Drupal 9.4.4 or higher prior to updating to Drupal 10, and should ensure update.php is run. This will ensure disabled CKEditor 4 plugins do not have their config stored.

• The pinned version of laminas/laminas-diactoros has been updated from 2.8.0 to 2.11.1.

Known issues

• #3285724: [regression] Drupal 9.4 breaks BC of \Drupal\Driver\* overriding core drivers during installation and parsing connection URLs
• #3290924: [regression] With Drupal 9.4, can no longer call Database::getConnection() from within settings.php due to driver classes not yet in autoloader
• #3290936: Argument #1 ($database) must be of type Drupal\Core\Database\Driver\mysql\Connection, Drupal\mysql\Driver\Database\mysql\Connection given
• #3294299: Regression in functional test performance with a large number of modules
• #3294695: Drupal 8 BC for database driver namespace fails for replicas

Search the issue queue for known issues.

All changes since 9.4.3

• Issue #3300518 by xjm, catch, neclimdul: Update Diactoros lock file version
• Issue #3292380 by Spokje, xjm, catch, larowlan, effulgentsia: Remove the "replace" section from core/composer.json
• Issue #3295935 by lauriii: Follow-up to #3268983: Move test case to correct group
• Issue #3295487 by Anjali Rathod, apaderno: HtmlFormController's contructor says it constructs a new \Drupal\Core\Routing\Enhancer\FormEnhancer object
• Issue #2939237 by Anjali Rathod, pooja saraah, apaderno, eojthebrave: Update the description given for $form_id
• Issue #3295972 by Munavijayalakshmi, nitin_lama, arunkumark, cilefen, Krilo_89: Wrong documentation since Drupal 8 for 'initial_form_field'
• Issue #3188327 by DeFr, longwave, ravi.shankar, quietone: Docblock of BaseFieldDefinition::setDisplayOptions still mentions setting type = hidden instead of region = hidden
• Issue #3281996 by rpayanm, Fabianx: UncaughtExceptionTest is not working when using recommended-project
• Issue #2464041 by Mile23, quietone, andrewsuth: Test unit behavior of EntityStorageBase::load(), loadMultiple() with invalid ID, UUID
• Issue #3281535 by mondrake, Spokje, daffie, alexpott: Fix 'Access to an undefined property' PHPStan L0 errors in test code
• Issue #3298821 by alexpott, catch, Spokje: Remove test that tests drupal/core-composer-scaffold when it is not allowed
• Issue #2820580 by anavarre, hardikpandya, Wim Leers, Berdir, cilefen: Drupal >=8.2.x doesn't allow to override all cache bins with $settings['cache']['default'] anymore, documentation says otherwise
• Issue #3292980 by benjifisher, mikelutz, quietone: Testing system should explain why Guzzle responses can be unreadable
• Issue #3204929 by longwave, donquixote, andypost: Html::load() inconsistent space removal with old libxml2 versions
• Back to dev.
• Merged 9.4.3.
• Issue #3270831 by Wim Leers, bnjmnm, xjm, catch: Make the CKEditor 4 → 5 upgrade path work even when the CKEditor 4 module is removed
• Issue #3295085 by xjm, catch, quietone, lauriii: [9.4 ONLY] Lower RECOMMENDED_PHP to 8.0
• Issue #3088234 by tim.plunkett: Use $defaultTheme for using views_test_classy_subtheme
• Issue #3245967 by bnjmnm, Wim Leers, nod_, lauriii, tim.plunkett, andregp, Antoniya, AaronMcHale, rkoller, cedewey, worldlinemine, shaal: Messages upon switching to CKEditor 5 are overwhelming
• Issue #3268983 by nod_, iSoLate, plach, Wim Leers, acbramley, larowlan, scott_euser, catch: [regression] FilterHtml throws Unsupported operand types error when * used in tag attribute
• Issue #3291887 by alexpott, Spokje: Fix outdated references to form_type_checkboxes_value()
• Issue #3246246 by Wim Leers, effulgentsia, lauriii, xjm, nod_: CKEditor 5 plugins needing more complex conditions: point to handbook page
• Issue #3295421 by Gábor Hojtsy, catch, atuliet05: Update TranslationWrapper deprecation to removal in 11.0.0
• Revert "Issue #3268983 by nod_, iSoLate, plach, Wim Leers, acbramley, larowlan, scott_euser: [regression] FilterHtml throws Unsupported operand types error when * used in tag attribute"
• Issue #3268983 by nod_, iSoLate, plach, Wim Leers, acbramley, larowlan, scott_euser: [regression] FilterHtml throws Unsupported operand types error when * used in tag attribute
• Issue #3291744 by lauriii, xjm, Abhijith S, catch, Wim Leers, bnjmnm: Ensure Editor config entities using CKEditor 4 only store plugins settings for actually enabled plugins
• Issue #3293996 by narendra.rajwar27, tbisciglia: Use getStorage('taxonomy_term') instead of getStorage('taxonomy_vocabulary')
• Issue #3266123 by smustgrave, tinto, rkoller, Lendude, larowlan, Amber Himes Matz: On the user interface translation page the outline of all four focusable elements in the filter translatable strings fieldset lacks the left border
• Issue #2916682 by Matroskeen: Defaults not working for grouped filter with multiple selections
• Revert "Issue #3082211 by quietone, Pooja Ganjage, danflanagan8, Spokje, benjifisher, Wim Leers, mikelutz: Migrate UI tests should provide the complete log message on failure"
• Issue #3293122 by lauriii: Document \Drupal\Core\Template\TwigExtension::getPath $parameters argument as optional
• Issue #3082211 by quietone, Pooja Ganjage, danflanagan8, Spokje, benjifisher, Wim Leers, mikelutz: Migrate UI tests should provide the complete log message on failure
• Issue #2994000 by Lendude, Pasqualle, quietone, pameeela: Notice in logs when setting invalid translation config for a content type
• Issue #3121325 by uqjhawk3, Berdir: FieldUiTestTrait::fieldUIAddExistingField() can randomly fail in javascript tests when no label is provided
• Issue #3270564 by quietone: Handle NULL for data blob in User source plugin
• Issue #2494617 by Lendude, danflanagan8, Bès, Shreya Shetty, stBorchert, Boobaa, DuaelFr, joey-santiago, drubb, nikitagupta, dawehner, alexpott: TermName views argument_validator is not working as expected
• Issue #3207771 by scott_euser, quietone, immaculatexavier, ravi.shankar, joachim: Menu UI node type form documentation points to non-existent function
• Issue #2859197 by Wim Leers, Abhijith S, borisson_, lauriii, swentel, joachim: Document that block_content entities are not designed to be displayed outside of blocks
• Issue #3137119 by munish.kumar, johnwebdev, Jaypan, jungle, xjm, catch: User::setExistingPassword() does not return $this for chaining
• Issue #3284665 by arunkumark, Rashmisoni, Jimaginary, Rakhi Soni, longwave: Minor typo in @see reference ("ManyTonOneHelper")
• Issue #3294883 by marcoscano: Fix inaccurate code comment in Media.php