This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about Drupal 10.
Drupal 10.3.x will receive security coverage until June 2025.
The Twig templating library has issued a security advisory. Drupal core is not vulnerable, but previous versions of the drupal/core-recommended package only allowed insecure versions of Twig to be installed. This patch release upgrades Twig to 3.19.0 as a public security hardening.
All changes in this release
- Issue #3503195 by alexpott, longwave, loopy1492: Twig needs updating for CVE-2025-24374
- Issue #3490710 follow-up by alexpott: Catch potential exception when calling Request::create() in PathBasedBreadcrumbBuilder
- Issue #3496438 by spokje, larowlan: [random test failure] LanguageNegotiationInfoTest::testInfoAlterations
VCS Label
10.3.12
Short description
Actively maintained with bugfixes and forwards compatibility backports every six months. Use this version if you already have a Drupal 10 site, until you're ready to update to 11.x.
Packaged Git sha1
b493aadf47378167c8093de5f043f249dd76e308
Release files
1686f9f5d8d77c439ca76c045a087a52
Release file SHA-1 hash
681ffc18bb4688e131622527d80d28b7d0858a44
Release file SHA-256 hash
d480a88ced7110918e344831f9bc2881c3dc9e9d757f5cce4475602bc4c45b27
ccb5f302e3adef46367f1254b5adb964
Release file SHA-1 hash
53e5e1efd37d804b14915d1c5adfdbbee0cbf21d
Release file SHA-256 hash
d2a8521284c0c89b0c6798d21e56d346be1227ecde8177e06209e9a4180a070e