Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
I installed Drupal (11.3.9) using the following line: composer create-project drupal/recommended-project my_site_name.
When I try to update Drupal to 11.3.10 using the following line: composer update "drupal/core-*" --with-all-dependencies,
I get the following message: Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Recently I received a message from my hosting provider regarding a vulnerability in two websites running Drupal 11.3.10:
The vulnerability (a code-injection) has been found in the database-environment of your Drupal install, in the file: condition.php.
That was patched by patchman they run automatically. It appears to be a vulnerability still present in the latest version of Drupal. Because after creating a fresh 11.3.10 install on a subdomain, I receive the exact same alert.
That's why I post this here, so it can be taken up and fixed ASAP.
My site is in Drupal 11.3.10, and I was notified by the system that there are available updates. I ran "composer upgrade" as usual and my site was upgraded to Drupal 11.4.x-dev.
My composer.json has the following relevant bits:
"minimum-stability": "dev", (I use some modules with "dev" versions)