drupal 10.2.1

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about Drupal 10.

Drupal 10.2.x will receive security coverage until December 2024.

Important update information

• If you are updating from Drupal 9, refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 10 compatibility of modules, themes and sites. Then, upgrade from Drupal 9 to 10. You should also check the Drupal 10.0.0 release notes.

• Drupal 10.2.1 resolves an information disclosure vulnerability that was introduced in 10.2.0. In Drupal 10.2.0, media item revisions are incorrectly shown to users who have access to the published revision. If you are using media revisions you are urged to upgrade immediately. Sites that do not use the Media module or sites on Drupal 10.1 or earlier are not affected.

All changes in this release

• Issue #3399373 by mstrelan, xjm, longwave, larowlan, quietone: Add declare(strict_types=1) to all Unit tests
• Issue #3411921 by catch: Start FunctionalJavaScript tests before Functional tests
• Issue #3412135 by markdorison: Output buffering status check fails when run via CLI
• Issue #3409982 by claudiu.cristea, longwave, alexpott, catch, Ghost of Drupal Past: [D10.2 regression] Theme suggestions cannot alter variables anymore
• Issue #3387163 by smustgrave, larowlan, alexpott, xjm, quietone: Decouple tour from ConfigInstallProfileOverrideTest
• Issue #3402618 by zniki.ru: Replace $GLOBALS['base_root'] with getAbsoluteUrl() in Functional Test
• Issue #3411837 by larowlan, longwave, catch, uditrawat, marcoscano, smustgrave, cilefen, greggles: Media revision listing is accessible to anonymous users
• Issue #3412160 by catch: Uncaught exception thrown when running database updates via drush
• Issue #3409525 by Wim Leers, Lee56, larowlan, cilefen, catch: Regression from #3341682: #states + #required do not automatically work together, resulting in an unsubmittable AccountSettingsForm
• Issue #3390178 by godotislate, larowlan, catch, pixlkat, Utilvideo, rsnyd, Wim Leers, cilefen, smustgrave, fjgarlin, jakegibs617, seixas, mohithasmukh, very_random_man: big_pipe sometimes fails to load blocks
• Issue #3410022 by heddn, larowlan, catch: Regression from #3295790 content-length header set earlier than expected
• Issue #3399160 by mfb, smustgrave, bradjones1, Ghost of Drupal Past: Support MySQL GIPK mode
• Issue #3410303 by longwave, Luke.Leber, Wim Leers, quietone, dslatkin: FilterHtml data loss when iframe and/or textarea is allowed
• Issue #3410126 by kim.pepper, catch, larowlan, DamienMcKenna, alexpott: File validation logic from #3221793 broke backwards compatibility
• Issue #3396559 by alexpott, catch: Only set content-length header in specific situations
• Issue #3347144 by dgtlmoon, mstrelan, Evaldas Užkuras, bkosborne, FeyP, pirvudoru: Form API #states property/states should use .once() to apply its rules (Can cause failures with BigPipe and possibly other situations)
• Issue #3396536 by fjgarlin, catch, kim.pepper: [random test failure] Re-enable AjaxTest::testAjaxFocus()
• Issue #3379220 by kristiaanvandeneynde, smustgrave, Wim Leers: system_page_attachments() varies by authenticated user role but does not add said cache context
• Issue #3411419 by catch, lauriii, larowlan, kevinquillen: Regression from #2521800: using machine name element for ListStringItem breaks with existing data
• Issue #3410093 by bnjmnm: [regression] install_get_form does not allow install_settings_form ['driver'] to be null
• Issue #3214208 by gapple, Akhil Babu, larowlan, smustgrave: FinishResponseSubscriber could create duplicate headers
• Issue #3214208 by gapple, Akhil Babu, larowlan, smustgrave: FinishResponseSubscriber could create duplicate headers
• Issue #3345197 by _shY, pradhumanjain2311, joachim, longwave: loadByProperties() and buildPropertyQuery() should document that you can pass value arrays to get an IN query condition
• Issue #3409663 by sakthi_dev, gorkagr, smustgrave: Remove datetime_range icon and library
• Issue #3410450 by catch: Fix random performance test failures
• Issue #3410419 by catch: Only clear flood attempts when necessary during user login
• Issue #3410452 by catch: Add @group #slow to more tests
• Issue #3410396 by catch: Add @group slow to ForumTest, HelpTopicSearchTest, ModulesListFormWebTest
• Issue #3410104 by ravi kant, Wim Leers, KlemenDEV: [10.2 regression] CKEditor 5 image button is missing icon
• Issue #2983058 by arnested, smustgrave, larowlan: FileUrlGenerator::transformRelative() edge case errors
• Issue #3161320 by neclimdul, Beakerboy, smustgrave: Drupal\Tests\Composer\Plugin\VendorHardening\ConfigTest leaking configuration changes
• Issue #2575945 by Sutharsan, mstrelan, tobiasb, ranjith_kumar_k_u, andypost, ericdsd, smustgrave, Ammaletu: A new module version is not recognized by interface translation update
• Issue #3071143 by KarimB, samsylve, smustgrave, quietone: Table Render Array Documention Is incomplete and confusing
• Issue #3340154 by godotislate, smustgrave: Link-widget throws exception when rebuilding a form with an invalid uri
• Issue #3410301 by catch, diqidoq, Wim Leers: Deprecate system.performance stale_file_threshold
• Issue #3410312 by catch: Flood database backend ::isAllowed() should call ::ensureTableExists()
• Issue #3371869 by quietone: Fix dependencies of taxonomy term translation migrations
• Issue #3395626 by amateescu: Fix workspace-support check in entity queries
• Issue #3404975 by Akhil Babu, joachim, smustgrave: Editor entity class should document that it expects a 1-1 relationship with matching IDs with a format entity
• Issue #3402173 by sijumpk, Abhijith S, longwave, smustgrave: Remove @backtrace_string in ExceptionLoggingSubscriber::onClientError()
• Issue #3383219 by Lendude, greatmatter, HeikkiY, PapaGrande, hansfn: Views RSS Feed Fields adds tag
• Issue #3337295 by Akhil Babu, zniki.ru, rksyravi, quietone, harshitthakore, Indrapatil, smustgrave, longwave, poker10: Remove remaining uses of t() in assertEquals() calls
• Issue #2183565 by plopesc, alexpott, jcnventura, DuaelFr, melvinlouwerse, grndlvl, cesarmiquel, Sweetchuck, yogeshmpawar, BetoAveiga, Sivaji_Ganesh_Jojodae, drugan, marvil07, smustgrave, poker10, catch, bbrala: Avoid loading all terms on the taxonomy overview form
• Issue #3403999 by acbramley, Primsi, LeDucDuBleuet, godotislate, Lendude: Exposed filter values ignored when using batch
• Issue #3408129 by Spokje, smustgrave: Sync up core/.stylelintrc.json and stylelint-config-standard
• Issue #3409413 by gorkagr, lauriii, longwave: Error TypeError: Drupal\Core\Field\FieldTypeCategory::getDescription() if a FieldType has 'description' missing in its annotation
• Issue #3377657 by catch, mondrake: Add database query spans to otel traces
• Issue #3403382 by alexpott, Wim Leers: BuildTestBase makes assumptions it should not about the code layout
• Back to dev.