drupal 11.1.3

This is a security release of the Drupal 11 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Critical - Cross-Site Scripting - SA-CORE-2025-001
• Drupal core - Moderately critical - Access Bypass - SA-CORE-2025-002
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-003

No other fixes are included.

• Drupal 11.1.x will receive security coverage until December 2025 when Drupal 11.3.0 is released.
• Sites on Drupal 11.0.x should update immediately to Drupal 11.0.12.
• Sites on Drupal 10.4.x should update immediately to Drupal 10.4.3.
• Sites on Drupal 10.3.x should update immediately to Drupal 10.3.13.
• Drupal 10.2.x and below are end-of-life and do not receive security coverage.

Important update information

Users now need the “Administer content” permission (administer nodes) to perform certain bulk operations. Alternatively, sites can install the Granular Node Permissions module and grant more specific permissions.