Drupal Release Notes

This is a beta release for the next major version of Drupal. Drupal 12 beta releases are intended for site owners and module or theme authors to test compatibility and upgrade paths for Drupal 12.0. Beta releases are not intended for production. Refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 12 compatibility of modules, themes, and sites. For more information on 12.0.x development, see [meta] Release Drupal 12 in 2026. The 12.0.x branch also includes all the latest commits that will be backported to 11.5.x and earlier branches. 12.0.x will be nearly identical to 11.5.x except that:

1. Deprecated code will be removed, including entire deprecated modules and themes.
2. Dependencies will be updated to new major versions as appropriate.

Important changes

Platform requirements changes

PHP requirements

• Drupal 12 requires PHP 8.5.
• The default password hashing algorithm was switched to argon2id in Drupal 12. For the rare case where this is not desirable - or argon2 is not available - it can be switched to the PHP default algorithm (bcrypt) using kernel parameters.

Database requirements

The requirements for the database drivers supported by Drupal 12 are:

• The MySQL database driver requires MySQL 8.0. …

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.3.x will receive security coverage until December 2026.

All changes since 11.3.17

• fix: #3625969 Twig's 3.30 TypeError: Twig\Runtime\EscaperRuntime::escape(): Argument #4 ($autoescape) must be of type bool, null given
• fix: #3623728 Node.js v24 upgrade fails all Nightwatch test runs
• fix: #3620645 Guzzle FW Gadget Chain shim followup
• task: #3615396 Update PHP_CodeSniffer to 3.13.6
• fix: #3614837 add SQLi protections to deprecated pgsql entity query condition class (11.x only)
• task: #3614340 Update to Twig 3.28
• task: #3612448 Widen constraints in core-recommended for 11.3.x and 10.6.x

Release type: 

Bug fixes

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 10.6.x will receive security support until December 2026.

Drupal 10.5.x security support has ended. Sites on any Drupal version prior to 10.6.x should upgrade to a supported release as soon as possible.

All changes since 10.6.17

• fix: #3625969 Twig's 3.30 TypeError: Twig\Runtime\EscaperRuntime::escape(): Argument #4 ($autoescape) must be of type bool, null given
• Merged 10.6.17.
• fix: #3620645 Guzzle FW Gadget Chain shim followup
• fix: #3536795 "Only file JavaScript/CSS assets can be optimized" errors in logs
• docs: #3618255 FormValidator refers to self::METHODS() which don't exist
• fix: #3614246 Media library grid items without a preview thumbnail collapse and hide the item name …

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

• fix: #3625969 Twig's 3.30 TypeError: Twig\Runtime\EscaperRuntime::escape(): Argument #4 ($autoescape) must be of type bool, null given
• test: #3618586 default_admin loses the footer group on forms that set #tree, silently unpublishing entities on save
• fix: #3625553 Use MAJOR.x-dev for generated dev-main aliases so release branches don't break BuilderTest
• fix: #3625547 CurrentPathStack keeps every Request it has seen, so long-running processes leak memory
• fix: #3095257 Option for _none is removed once a field has a value and can cause accidental data corruption …

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

No other fixes are included.

Which release do I choose? Security coverage information

• Sites on Drupal 10.6.x or below should update immediately to Drupal 10.6.17. Drupal 10.6.x will receive security coverage until Drupal 10 is end-of-life in December 2026.
• Sites on Drupal 11.4.x should update immediately to Drupal 11.4.7.
• Sites on Drupal 11.3.x or below should update immediately to Drupal 11.3.17.
• Drupal 11.2.x and below as well as Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Release type: 

Security update

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

No other fixes are included.

Which release do I choose? Security coverage information

• Sites on Drupal 11.3.x should update immediately to Drupal 11.3.17. Drupal 11.3.x will receive security coverage until December 2026 when Drupal 11.5.0 is released.
• Sites on Drupal 11.4.x should update immediately to Drupal 11.4.7.
• Sites on Drupal 10.6.x or below should update immediately to Drupal 10.6.17.
• Drupal 11.2.x and below as well as Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Release type: 

Security update

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcement:

• Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

No other fixes are included.

Which release do I choose? Security coverage information

• Sites on Drupal 11.4.x should update immediately to Drupal 11.4.7. Drupal 11.4.x will receive security coverage until June 2027 when Drupal 11.6.0 is released.
• Sites on Drupal 11.3.x should update immediately to Drupal 11.3.17.
• Sites on Drupal 10.6.x should update immediately to Drupal 10.6.17.
• Drupal 11.2.x and below as well as Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Release type: 

Security update

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

All changes since 11.4.5

• fix: #3610122 Field data for multiple cardinality fields are not populated on entity load
• fix: #3389715 Diffs with different line endings leads to Invalid $mode 3 specified
• fix: #3610005 Styling not applied to Umami search form
• fix: #3619688 Button misaligned in exposed filters within Admin theme
• fix: #3618127 Navigation top bar action buttons in dark mode have low color contrast
• fix: #3580733 Views status field triggers a PHP 8.5 deprecation on /admin/people …