drupal 11.4.5

This is a patch (bugfix) release of Drupal 11 and is ready for use on production sites. Learn more about the latest version of Drupal.

Drupal 11.4.x will receive security coverage until June 2027.

All changes since 11.4.4

• task: #3614814 Promote pdureau from provisional to full front end framework manager
• fix: #3603762 HTML injection in ajax_page_state GET parameter
• fix: #3593346 Entity query __toString() does not invoke the query alter hooks
• fix: #3612540 [regression] Fix Toolbar with Default Admin
• fix: #3614837 add SQLi protections to deprecated pgsql entity query condition class (11.x only)
• task: #3614340 Update to Twig 3.28
• fix: #3611989 Workspace purge deletes entities that went live through another workspace
• fix: #3600904 Shipped configuration entities that do not have translatable elements are not set to the site default langcode
• task: #3593472 Insecure Direct Object Reference in Private File Uploads
• fix: #3600777 Redirects can be used to bypass AJAX trusted URLs
• fix: #3595497 Collapsed Details Element causes JS Error for required textarea and select fields
• fix: #3209204 Adding existing translation throws "Invalid translation language specified"
• fix: #3612945 [random failure] SymfonyMailerTest
• fix: #3613160 PHP 8.6 failure in FileStorageTest
• fix: #3612163 When installing themes on the Appearance page, batches added (eg. by locale) are never executed
• fix: #3613047 RouteProvider::__construct() BC branch assigns $table to $languageManager, causing fatal error on getCurrentLanguage()
• task: #3579778 Removed modules should be included as a replace in composer.json
• revert: #3591220 Remove DependencyFormTest.php committed to wrong issue.
• Revert "task: #3579778 Removed modules should be included as a replace in composer.json"
• fix: #3609119 links class missing from language switcher
• task: #3591220 Convert functional tests in taxonomy module to kernel tests
• task: #3578044 Clean up package manager
• task: #3579778 Removed modules should be included as a replace in composer.json
• fix: #3569316 Client connection () must be of type object, null given when deleting a node
• fix: #3610474 MigrateSourceTestBase has a typo about #[CoversClass]
• task: #3588332 file_tokens() fails when [file:owner] resolves on a file whose owner has been deleted
• Revert "fix: #3569316 Client connection () must be of type object, null given when deleting a node"
• fix: #3569316 Client connection () must be of type object, null given when deleting a node
• fix: #3607061 Don't spellcheck composer.json
• fix: #3608733 Ajax error when creating a new content view
• fix: #3607061 Don't spellcheck composer.json
• fix: #3593466 View mode form crashes if there are no bundles
• fix: #3611054 Stable9 lifecycle link is broken
• fix: #3611653 Upsert fails after upgrade from 11.3 to 11.4
• fix: #3611529 Moderation state field definitions can have an incorrect target bundle
• test: #3609757 Composer bin-dir setting is ignored
• fix: #3029122 Drupal returns a 500 Internal error when 'destination' url query value is numeric and less than 6 length
• fix: #3611084 DrupalApplication should use the compiled container
• fix: #2863785 Avoid PHP notice when comparing config without uuid
• Merged 11.4.4.
• Back to dev.