drupal 9.5.3

This is a patch (bugfix) release of Drupal 9 and is ready for use on production sites. Learn more about Drupal 9. Drupal 10.0.3 is also available.

Drupal 9.5.x will receive security coverage until November 2023.

If you are upgrading from Drupal 8, read upgrading a Drupal 8 site to Drupal 9, 9.0.0 release notes, and the 9.5.0 release notes before upgrading to this release.

Important changes since 9.5.2

Symfony dependencies have been updated to 4.4.50.

• Issue #3338301 by catch, longwave, benjifisher, jungle: Update Symfony to v6.2.6 / v4.4.50
• Issue #2867796 by murilohp, kkalashnikov, sophiavs, ameymudras, Ratan Priya, anagomes, alexpott, joachim: hook_theme() docs for path are inaccurate
• Issue #3087868 by Charlie ChX Negyesi, Wim Leers, joachim, smustgrave: Make the AccessResult API even clearer
• Issue #3337327 by Spokje: CSpell dictionary is out of sync
• Issue #3336002 by Gauravvv, nidhi27, bnjmnm: Claro: Select list chevron-down icon is showing on wrong position in RTL dir in views
• Issue #3178919 by andregp, AndyF, codebymikey, ankithashetty, Ankit.Gupta, alexpott, smustgrave, larowlan: Can't run tests with XDEBUG_CONFIG set to empty string
• Issue #3001430 by alexpott, _utsavsharma, lauriii, Oscaner, catch, smustgrave, ifux, deviantintegral, pameeela: Unable to uninstall base theme and subtheme via config sync at the same time
• Issue #3001430 by alexpott, _utsavsharma, Oscaner, lauriii, smustgrave, ifux, deviantintegral, pameeela: Unable to uninstall base theme and subtheme via config sync at the same time
• Issue #2574981 followup by xjm: Fix 'TTests'.
• Issue #2574981 by Manjit.Singh, dimaro, wengerk, darol100, izus, pguillard, vsujeetkumar, Himanshu5050, snehi, paulocs, rakesh.gectcr, jofitz, _utsavsharma, charginghawk, rajeshwari10, sdstyles, quietone, benjifisher, marcusvsouza, LoMo, joelpittet, justAChris, cilefen, YesCT, mradcliffe, spitzialist, annajl, jhodgdon, catch, alexpott, Sabbi0612, kattekrab, Mile23, antojose, leanderl, rodrigoac: Fix grammar ("an URL" should be "a URL") and consistent use of URL (not "url" / "Url") in documentation only
• Revert "Issue #3333401 by nicxvan, bnjmnm: Pager h4 causes accessibility flag on many pages"
• Issue #3305706 by znerol, SandeepSingh199, ivnish, smustgrave, Spokje, økse, ranjith_kumar_k_u, coffeemakr, DavorHorvacki: Uncaught TypeError: this.$pluginSelect.find(...)[0] is undefined
• Issue #3126127 by stefanos.petrakis, andypost, xjm, pooja saraah, Kristen Pol: Fix LanguageNegotiationMethodInterface::getLangcode() result docblock
• Issue #3333401 by nicxvan, bnjmnm: Pager h4 causes accessibility flag on many pages
• Issue #3294619 by mohit_aghera, Kasey_MK, smustgrave, alexpott: Missing schema for comment_link_approve views field configuration
• Issue #3092672 by _utsavsharma, apaderno, xjm, smustgrave: Remove outdated @todo from the Locale module
• Issue #1875020 by longwave, David_Rothstein, slip, alexpott, catch, smustgrave, jhodgdon: Cron queue gets processed every time cron is called, regardless of whether it's already being processed elsewhere
• Issue #3328005 by daffie, netsliver, andypost, mondrake: PHP 8.2 Creation of dynamic property Drupal\pgsql\Driver\Database\pgsql\Select::$alterMetaData is deprecated
• Issue #3334679 by Lugir: A minor code comment mistake in NodeFieldAccessTest.php
• Issue #3185640 by lucienchalom, jungle, smustgrave, ravi.shankar, andregp, xjm, quietone, sergiogsanchez: Fix or ignore words that start with "v", excluding real non-English words
• Issue #3327853 by Spokje, fabiansierra5191, xjm, longwave, rpayanm, bbrala: Don't allow {@inheritDoc} annotation in PHPDocBlocks
• Issue #3191389 by anmolgoyal74, greggles, larowlan, mcdruid, pwolanin, brayfe: File Inclusion issue security hardening
• Issue #3333858 by miiimooo, larowlan: Blocks that have #attached set removed after upgrade
• Back to dev.
• Merged 9.5.2.
• Issue #3191623 by mondrake, Medha Kumari, daffie, alexpott: Select queries do not escape the GROUP BY fields
• Issue #3219472 by quietone, xjm, Abhishek_Singh, karishmaamin, smustgrave, longwave: Fix spelling for words used once, beginning with 'e' -> 'i', inclusive
• Issue #3088168 by DuaelFr, dww, Ambient.Impact, alexpott: Media thumbnail dimensions are wrong for YouTube videos
• Issue #3260391 by huzooka, arunkumark, Spokje, quietone: BlockedIp::import violates MigrateDestinationInterface::import
• Issue #3332712 by Liam Morland, DanielVeza: Cron links point to D7 documentation
• Issue #3248575 by mfb, xjm: Documentation conflict re: affected rows vs. matched rows
• Issue #3317938 by catch, Lendude, nod_, quietone: views_ui LibraryCachIngTest is failing randomly
• Issue #3332447 by xjm, Spokje: Upgrade yarn dependencies to fix vulnerabilities shown by yarn audit
• Issue #992540 by valthebald, ndobromirov, jec006, kid_icarus, rickmanelius, mr.baileys, pguillard, joseph.olstad, vijaycs85, paulocs, voleger, Matt V., aerozeppelin, ravi.shankar, quietone, Munavijayalakshmi, ranjith_kumar_k_u, evilehk, swentel, gaurav.kapoor, yogeshmpawar, klidifia, pradhumanjainOSL, louis-cuny, catch, Everett Zufelt, alexpott, cilefen, xjm, grendzy, cashwilliams, borisson_, lachezar.valchev, tstoeckler, Heine: Nothing clears the "5 failed login attempts" security message when a user resets their own password
• Issue #3226334 by albertosilva, pauger, xjm, smustgrave, K3vin_nl, krisahil: PathAliasManager could not find the alias by the internal path
• Issue #3327974 by Lendude, ExTexan: The $entity_type property is protected, so fix views.api.php sample code to use a getter
• Issue #3323353 by Lendude, ameymudras, VitaliyB98, xjm, andypost: View combine filter operator "Is not equal to" use the same operator as "Is equal to"
• Issue #3331900 by noorulshameera, anmolgoyal74: Remove unused variable $translation from BulkFormTest
• Issue #3331818 by xjm, Spokje: commit-code-check.sh gives unclear output when CSS is not properly rebuilt
• Issue #3244737 by longwave, droplet, andypost, joshua1234511, Satyajit1990, klonos: "core/drupal.checkbox" (misc/checkbox.js) has never loaded on user permission page
• Issue #3324901 by alexpott: TestSettingSummariesContentType has a few problems
• Issue #3331438 by acbramley, mstrelan: Incorrect return type in LinkBase::getDefaultLabel()
• Issue #3331205 by larowlan, sanderwind: SSTI possible via translation of "Language" in CKEditor Language plugin
• Issue #3310555 by jonathan1055, smustgrave: htmlspecialchars(): Passing null to parameter #1 ($string) of type string is deprecated
• Back to dev.