search

Vardot / varbase-project

Project template for Varbase distribution
https://www.drupal.org/project/varbase
GNU General Public License v2.0
49 stars 35 forks source link

Update the composer.lock file after Drupal 10.3.5 was released #255

Closed Natshah closed 2 months ago

Natshah commented 2 months ago

Drupal 10.3.4 was released on: 11 Sep 2024 by: longwave https://www.drupal.org/project/drupal/releases/10.3.4

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites.

Thanks, to the Drupal Core committer and release teams. Noticed that it's a bugfix - feels like a quick fix release

The Twig templating library has issued a security advisory. Drupal core is not vulnerable, but previous versions of the drupal/core-recommended package only allowed insecure versions of Twig to be installed. This patch release upgrades Twig to 3.14.0 as a public security hardening.

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 Security Kit 2.0.3 was released on: 11 Sep 2024 by: mcdruid https://www.drupal.org/project/seckit/releases/2.0.3

After Issue #3473195: twig/twig has a possible sandbox bypass <v3.14.0 When updating to Drupal 10.3.4 you will face some Twig and styling issues like: Issue #3473757: Drupal 10.3.4 breaks some styling/layout Issue #3457168: Since twig/twig 3.9: error with "twig_escape_filter" function usage in /core/lib/Drupal/Core/Template/TwigExtension.php Seems that if we are using custom twig filters, or twig plugins/extensions, we need to make sure they are compatible with twig/twig ~3.14.0

✅ Released Varbase Patches 10.0.55 ✅ Released Varbase Patches 9.2.34 ✅ Released Varbase Patches 9.1.42 Added a patch for Drupal Core on Issue #3457168: Since twig/twig 3.9: error with "twig_escape_filter" function usage in /core/lib/Drupal/Core/Template/TwigExtension.php #82

Natshah commented 2 months ago

Drupal 10.3.5 was released on: 12 Sep 2024 by: catch https://www.drupal.org/project/drupal/releases/10.3.5

This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. This release reverts #3471741: Fix null $cid in CacheCollector classes, released in 10.3.4, which conflicted with Menu Trail by Path, Entity Manager and Gin Toolbar modules.