This is a security release of the Drupal 10 series.
This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:
- Drupal core - Moderately critical - Cross-Site Scripting - SA-CORE-2024-003
- Drupal core - Moderately critical - Access Bypass - SA-CORE-2024-004
- Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
- Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
- Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
No other fixes are included.
Which release do I choose? Security coverage information
- Drupal 10.2.x will receive security coverage until December 2024 when Drupal 10.4.0 is released and should plan to update to Drupal 10.3, 10.4, or 11 by December 2024.
- Drupal 8 and 9 are end-of-life and do not receive security coverage.
Important update information
As part of the protection against a potential vulnerability, additional checks have been added to some of Drupal core's database related code. If you use a third-party database driver that makes use of the Drupal\Core\Database\StatementPrefetchclass, you may need to allow-list the driver by adding it to settings.php.
Drupal Core's own database drivers (and the contrib sqlsrv driver) do not require additional configuration. The contrib Oracle driver is allow-listed by default.
Example for settings.php:
$settings['database_statement_prefetch_valid_db_drivers'] = ['mydbdriver'];