Drupal 8.9.5
4 September 2020
Drupal version 8.9.5 is now available (security release).
Upgrading to Drupal 8.9.5
Drupal 8.9.5 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply Drupal updates as new versions are released, or use Installatron's Clone feature to duplicate an existing Drupal install to test the 8.9.5 upgrade prior to applying it live. Get started managing your Drupal installations with Installatron
What's New in Drupal 8.9.5
8.9.5
This release provides hotfixes for two issues:
- Yesterday, Symfony issued a security advisory for their symfony/http-client component, which is not used by Drupal. The Symfony release also updated some compatibility code in the symfony/http-kernel component. Although Drupal is not affected by this vulnerability, some site owners reported automated security scanners flagging the http-kernel update as a security update, breaking continuous integration builds, etc. For simplicity, this release updates Drupal's metapackages to use the latest release of symfony/http-kernel (version 4.4.13).
- A regression in Drupal 9.0.4 and 8.9.4 caused Paragraphs modal dialogs to not be displayed correctly due to a CSS change in core. The issue that introduced this change has been reverted (#3070375: Hidden buttons in off-canvas dialog are not being hidden) so Paragraphs should again work as expected.
8.9.4
Bug Fixes
- Empty *.libraries.yml file can cause fatal error
- Exposed term filters should not show term options that the user does not have access to
- Exception is thrown on changing "Site language" setting of a user if user account is translated
- ExceptionLoggingSubscriber should not log backtrace string on access denied exceptions
- Fix DrupalCoreRenderElementEmail documentation
- Convert all PHPDoc links targeting JSON:API contrib issues to target Drupal core issues
- Reference to RFC5424 severity levels is incorrect
- The document comment for Image::scaleDimensions() contains a reference to a function that isn't implemented in Drupal 8 and 9
- Required fields are not identifiable on Internet Explorer 11 high contrast
- Content moderation state filter incorrectly groups content type condition
- Correct latest revision for node 1 in drupal6 test fixture
- Change static queries to dynamic queries in core/modules/{every module}/tests
- Correct PHP CodeSniffer coding-standards violation in autoload.php
- Unused variable $id in field module, BulkDeleteTest.php
- Typo in DeprecatedServicePropertyTrait
- [backport] rdf comment storage load should not load NULL comments
- [backport] Views UI tags do not use autocomplete suggestions
- [backport] Hidden buttons in off-canvas dialog are not being hidden
- [backport] $account->getDisplayName() should be used when outputing username in RDF module
- [backport] Replace use of whitelist/blacklist in Filter module
- [regression] Impossible to filter for resources with an empty relationship object in JSON:API 2.x