Security update

Changes since 7.x-1.0-beta5:

• Issue #160987 by bellesmanieres, sergiuteaca: Modules redirects to any URL passed as parameter

Maintenance and security release of the Drupal 8 series.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the notes below and the security announcements:

• Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004

No other fixes are included.

Known issues

In certain configurations and environments, batched exports may not be downloadable. A patch that should address the issue is available in #2800895-8: Access denied when performing batched export as admin.

Changes since 7.x-3.0-beta9:

This resolves the following SA:

• Flag Lists - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-051

No other updates are included in this release.

Please note that both the 7.x-1.x branch and the 7.x-3.x branch are affected.

This resolves the following SA:

• Flag Lists - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-051

No other updates are included in this release.

Please note that both the 7.x-1.x branch and the 7.x-3.x branch are affected.

This resolves the following SA:

• Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050

Changes since 7.x-3.7: