Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
#3592563:
Internal newlines in value and name allowed
line injection in downstream multi-key consumers. Both fields used to
accept any internal ASCII control character (C0 range + DEL). The
constraint validator's strict base64_decode blocked
OpenSSH-style SHA-256 fingerprints. Stored fingerprints move from md5-hex to SHA256:<base64> (matches ssh-keygen -lf). Run drush updatedb after upgrading — existing rows are migrated in batched chunks.
Minimum RSA modulus length as a per-field setting (default 2048 bits; 0 disables). Enforced via phpseclib.
Full structural validation. Every accepted algorithm is parsed by