drupal 8.5.12

Update: Drupal 8.5.13 is available and fixes a critical issue with 8.5.12 for some themes.

This is a patch release of Drupal 8 and is ready for use on production sites. Learn more about Drupal 8.

Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. Sites on 8.5.x will receive security coverage until May 2019 (when 8.7.0 is released).

Important update information

This release resolves two critical issues affecting Drupal 8 site updates:

• The third-party Twig library, which powers Drupal 8's theme system, recently released a new minor version (1.38.0) that introduced a fatal error when used with Drupal 8. As a result, Drupal 8 sites managed with Composer encountered this fatal error when updating Twig to version 1.38.0 or 1.38.1. This release updates Drupal to require Twig 1.38.2, which resolves the fatal error.

• The recent releases for SA-CORE-2019-003 introduced a serialized data integrity issue affecting some contributed and custom modules, including the Default Content and Paragraphs modules. This release resolves the issue for affected sites.

Additionally, this release resolves an administrator-only access bypass with the Layout Builder module. Previously, users who didn't have access to view individual entities were still granted access to configure the layout for that entity (if per-entity layout configuration was enabled) and therefore could view its content. This implicit access has been removed. Site owners should ensure that all content editor roles have access to view the content for which they are configuring the layout.

No other fixes are included as Drupal 8.5 is no longer actively supported.

Known issues

• #3026560: After upgrade to 7.63, 8.6.7, or 8.5.10 still get TYPO3 phar error for drush
• #3026443: \Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar()
• #3031128: Update from 8.6.7 to 8.6.8 warnings - Drupal\Core\Extension\Extension has no unserializer
• #3040210: Updating twig/twig to v1.38.2 (included in Drupal 8.6.11) causes fatal error when embed tags are used in templates