We’ve shipped WMS Drupal 3.3.3, a focused patch on top of 3.3.2. This release addresses the June 2026 Paragraphs security advisories and ships a small fix in the Lehigh 2018 migration package. There are no Drupal core bumps, no config changes, and no new platform features—just dependency updates in composer.lock.
Security and maintenance
Keeping contrib current is non-negotiable. This release includes:
drupal/paragraphs1.20.0 → 1.21.0 — security release addressing SA-CONTRIB-2026-061 (moderately critical access bypass) and SA-CONTRIB-2026-060 (less critical access bypass). Both advisories affect the optional Paragraphs Library submodule (paragraphs_library). Sites that do not enable that submodule are less exposed, but upgrading is still recommended for every deployment on the platform.
What to do: Run composer install and drush updatedb on each environment after deploying. Apply on stage first, then production on your usual schedule. If your site uses Paragraphs Library for reusable paragraph items, smoke-test library autocomplete and any views that list library items after upgrade.
Migration package (DRUP-3869)
We’ve updated lehigh-drupal/lehigh_migration_lehigh2018 to 1.9.24, which corrects hostname handling during Lehigh 2018 source migrations for websites losing .web in their URL (ie. baltrusaitislab.web.lehigh.edu). lehigh-drupal/lehigh_migration_lehigh2018 was updated to handle these cases.
Upgrade notes
This is a dependency-only patch since 3.3.2:
For the full commit-level history, see CHANGELOG.md on the 9.x branch.