Security update

Fix XSS broken twig function and potential XSS vulnerability in both the filter and function.

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
• Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Important update information

• This release updates the pinned versions of Composer to 2.9.7 for several Composer security fixes that were released today. Drupal does not expose these vulnerabilities, but the update is included as a hardening for other applications that may extend the library directly.

No other fixes are included.

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
• Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Important update information

• This release updates the pinned versions of Composer to 2.9.7 for several Composer security fixes that were released today. Drupal does not expose these vulnerabilities, but the update is included as a hardening for other applications that may extend the library directly.

No other fixes are included.

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
• Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Important update information

• This release updates the pinned versions of Composer to 2.9.7 for several Composer security fixes that were released today. Drupal does not expose these vulnerabilities, but the update is included as a hardening for other applications that may extend the library directly.

No other fixes are included.

This is a security release of the Drupal 11 series.

Note: This release introduces a regression for configuration import that could result in data loss in certain scenarios. Sites should update directly to Drupal 11.3.8 instead of this release.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
• Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
• Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

Important update information

• This release updates the pinned versions of Composer to 2.9.7 for several Composer security fixes that were released today. Drupal does not expose these vulnerabilities, but the update is included as a hardening for other applications that may extend the library directly.