This is a security release for Google Tag 2.x. No other changes have been made since 2.0.7.
Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012
NOTES - This release is compatible with Drupal 8.8, 8.9, 9.x, or 10.x. - It may be necessary to apply the core patch in #3114467: 'Negate' form value for condition plugins should be cast to boolean in validation. if the GTM snippets are no longer added to the page. This applies if other modules defining condition plugins are used on the site.
catch of the Drupal Security Team, Dieter Holvoet, Heine Deelstra of the Drupal Security Team
Issues: 1 issue resolved.
Changes since 1.0.3:
Resolves AI (Artificial Intelligence) - Access bypass, Information disclosure - SA-CONTRIB-2025-004
Also:
Bug fixes
Added CSRF check on the Deepchat endpoint.
See AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003.
In addition to the news page and sub-tabs, all security announcements are posted to an email list. To subscribe to email: log in, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.
You can also get rss feeds for core, contrib, or public service announcements or follow drupalsecurity@drupal.community on Mastodon or @drupalsecurity on Bluesky.
In order to report a security issue, or to learn more about the security team, please see the Security team handbook page.
If you are a Drupal developer, please read the handbook section on Writing secure code.
