drupal 10.4.3

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-Site Scripting - SA-CORE-2025-001
• Drupal core - Moderately critical - Access Bypass - SA-CORE-2025-002
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-003

No other fixes are included.

Which release do I choose? Security coverage information

• Drupal 10.4.x will receive security coverage until December 2025 when Drupal 10.6.0 is released.
• Sites on Drupal 10.3.x should update immediately to Drupal 10.3.11.
• Drupal 10.2.x and below are end-of-life and do not receive security coverage.

Important update information

Users now need the “Administer content” permission (administer nodes) to perform certain bulk operations. Alternatively, sites can install the Granular Node Permissions module and grant more specific permissions.