• Posted:

  • Type:Blog Post
  • Type:Claude

Three releases went out since 4.0.1. Most of it is security work: 11 advisories closed across core and contrib, two of them Critical. 

Security

  • Drupal core 10.6.17 → 10.6.19 (4.0.2, DRUP-4089): SA-CORE-2026-014 (Critical, Field UI remote code execution), SA-CORE-2026-015, and SA-CORE-2026-016. Field UI is only on in the dev_ui split, so production and stage were not exposed to the Critical one. 4.0.4 then moves core to 10.6.20, a bugfix release.
  • Stage File Proxy 3.1.6 → 3.1.7 (4.0.4, DRUP-4090): SA-CONTRIB-2026-286 (Critical, XSS). The module is enabled on production sites too.
  • Rabbit Hole 1.2.0 → 1.3.0 (4.0.4, DRUP-4090): SA-CONTRIB-2026-252. A query parameter let anonymous visitors skip the 404/403 that hides term pages on every site.
  • CAPTCHA 2.0.10 → 2.0.11 (4.0.4, DRUP-4090): SA-CONTRIB-2026-281. A solved CAPTCHA now shows again when another field on the form fails validation. That is expected.
  • Gin 4.1.4, Leaflet 10.4.13, Menu Link Attributes 1.10.0, Easy Breadcrumb 2.0.11, Entity 1.8.0 (4.0.2, DRUP-4089): SA-CONTRIB-2026-219, -204, -209, -212, and -113.

What changed for editors

  • Repository site: content managers can now manage Repository Category terms and run the repository item CSV Feeds import themselves (4.0.4, DRUP-4100).
  • Safari: lehigh_clutch 2.0.4 drops the Safari focus polyfill (4.0.3, LTS-68142).
  • Rabbit Hole and CAPTCHA: hidden term pages stay hidden, and CAPTCHA re-asks after a failed submit, as above.

Maintenance

  • Contrib wave (4.0.2, DRUP-4089): Better Exposed Filters 7.2.0, Layout Paragraphs 2.1.5, Klaro 3.1.2, External Auth 2.0.15, Trash 3.0.35, Linkit 7.0.17, Editoria11y 2.2.24, Draggable Views 2.1.5, File (Field) Paths 1.0.0, Views Selective Filters 2.0.0-rc1, and smaller bumps. The local Draggable Views and Rabbit Hole patches were dropped with these updates.
  • Better Exposed Filters' new no_reset key is backfilled into 36 filters and sorts across 12 split views, so the deploy's config import no longer reverts it (4.0.2).
  • Textfield Counter 2.6.0 (4.0.4).
  • Klaro locally: the dev split no longer overrides exclude_urls, and the consent cookie uses .ddev.site under DDEV (4.0.2, DRUP-4070, DRUP-4081).

Deploy and CI

  • deploy:prod is now a manual job on 9.x (4.0.4, DRUP-3738).
  • PHP Parallel Lint runs on every non-9.x branch push (4.0.4, DRUP-3738).
  • On sites with large Feeds or migration imports, expect a longer drush updatedb: rabbit_hole_update_8102 fills in Rabbit Hole defaults on node and term rows.