This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about Drupal 10.
Drupal 10.3.x will receive security coverage until June 2025.
The Twig templating library has issued a security advisory. Drupal core is not vulnerable, but previous versions of the drupal/core-recommended package only allowed insecure versions of Twig to be installed. This patch release upgrades Twig to 3.14.0 as a public security hardening.
Known issues
- [#3471741] conflicts with Menu Trail by Path, Entity Manager and Gin Toolbar modules.
Important update information
If you are updating from 10.2.x or earlier and have the CKEditor font module installed, you should consider switching to CKEditor5 Plugin pack for a more up-to-date version of the plugin which is compatible with the CKEditor5 version shipped with Drupal 10.3. If you are updating from Drupal 9, refer to Preparing your site to upgrade to a newer major version for tools you can use to check the Drupal 10 compatibility of modules, themes and sites. Then, upgrade from Drupal 9 to 10. You should also check the Drupal 10.0.0 release notes.
All changes in this release
- Issue #3473195 by longwave, catch, jurgenhaas, naveenvalecha, quietone: twig/twig has a possible sandbox bypass
- Issue #3472092 by nicxvan, smustgrave: Remove references to ApcClassLoader (removed in Symfony 4)
- Issue #3471741 by mstrelan, bbrala, kristiaanvandeneynde: Fix null $cid in CacheCollector classes
- Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests
- Revert "Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests"
- Issue #3469309 by mstrelan, smustgrave, moshe weitzman: Use one-time login link instead of user login form in BrowserTestBase tests
- Issue #3454507 by hablat, catch: Aggregated asset generation causes uncacheable assets
- Issue #3472592 by smustgrave: Fix Book breadcrumb cacheability
- Issue #3471977 by grimreaper: Drupal.dialog openDialog should use event settings
- Back to dev.