drupal 9.4.0-beta1

This is a beta release for the next minor (feature) release of Drupal 9. Betas are good testing targets for developers and site builders who are comfortable reporting (and where possible, fixing) their own bugs. Beta releases are not recommended for non-technical users, nor for production websites. More information on beta releases.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-010

This minor release provides new improvements and functionality without breaking backward compatibility (BC) for public APIs. Note that there may be changes in internal APIs and experimental modules that require updates to contributed and custom modules and themes per Drupal core's backwards compatibility and experimental module policies.

Drupal 9.4.x contains new features, and should be the target for new site development. Drupal 9.3.x will continue to have security support until December 2022. Security support for 9.2.x ends with the release of 9.4.0 on June 15, 2022.

Important changes since Drupal 9.4.0-alpha1

• The minimum supported PHP version is now set dynamically based on the documented end-of-life date for each PHP version. After a PHP version is no longer supported, there will be warnings about the unsupported PHP version, but this won't prevent running, updating, or installing Drupal. In order to provide sites with the most complete information on which PHP versions are supported and recommended for their current installation, \Drupal::MINIMUM_SUPPORTED_PHP is deprecated and replaced by \Drupal\Core\PhpRequirements::minimumSupportedPhp(). Review the handbook documentation on unsupported PHP versions for more information.

• The theme used when update.php is run and there is no maintenance_theme selected in settings.php has changed. If Claro is installed it will be used, if not Seven is used if it is installed. If neither Claro and Seven are installed, the default theme is used. Review the change record on the maintenance theme changes for more information.

• The Modernizr.touchevents test has been deprecated. In addition, Modernizr is no longer responsible within Drupal for detecting touch devices and adding the touchevents/no-touchevents classes to the HTML element based on the detection result. The specific functionality of adding classes based on touch device detection is now provided via a core library: core/drupal.touchevents-test. The detection method used is identical to Modernizr's.

  Themes relying on the selector do not need to change, but code calling Modernizr directly should be updated.

• ​​The JavaScript API for Contextual module has been marked internal, and various parts of this will be refactored and/or removed in Drupal 10. Contributed modules should interact with contextual module only via the PHP API.

• Color module is deprecated. Review deprecation documentation for more information.

Backend dependencies

• Sites are able to install Guzzle 7 due to a widening of Drupal core's composer constraints. This allows for more complete PHP 8.1 support. Contributed modules should continue to provide Guzzle 6 support since both the drupal/core-recommended package and core tarballs continue to provide Guzzle 6.

  Site owners who do not use drupal/core-recommended should take care to ensure they do not accidentally update to Guzzle 7 when running composer updates. In the latest snapshot channel of Composer, it is possible to use:

  composer update --with=guzzlehttp/guzzle:^6 -W
  

  You can update to the snapshot channel by re-running composer self-update after updating to the current stable release (2.3.5). You can roll back to a stable version at any time by using composer self-update --rollback.

  In current stable releases of Composer, a workaround is to temporarily add a top-level requirement on the exact version of Guzzle you which to install, e.g.:

  composer require guzzlehttp/guzzle:6.5.6
  composer update
  

  ...and then remove the specific guzzle requirement from the top-level composer.json for your project.

• Drupal core's pinned Composer dependency versions have been updated for the latest minor and patch releases.

  Additionally, Drupal core’s composer constraints have been increased to require the latest minor version for forward compatibility. This ensures that if any composer package that Drupal core depends upon has a security release, the Drupal core security update will be non-disruptive, because if possible no minor version increase will occur for the affected dependency, only a patch version increase.

• The following packages have received minor-level updates since alpha1:

  • egulias/email-validator, from 3.1.2 to 3.2.
  • laminas/laminas-diactoros, from 2.10.0 to 2.11.0.
  • twig/twig, from 2.14.13 to 2.15.1.

• The composer/xdebug-handler dependency has received a major version update that removes support for PHP versions not supported for Drupal 10.

Frontend dependencies

• CKEditor 5 has been updated from 34.0.0 to 34.1.0, which fixes several bugs affecting Drupal core.

Additionally:

• Shepherd.js is updated to 9.1.0.
• SortableJS is updated to 1.15.0.
• tabbable is updated to 5.3.2.

For all three of these updates, according to the projects' release notes, there should be no breaking changes that affect our usage.

Development dependencies

• Coder has been updated to 8.3.15. This version will automatically set up Drupal coding standards sniffs in PHP_CodeSniffer thanks to a new dependency on dealerdirect/phpcodesniffer-composer-installer.

All changes since 9.4.0-alpha1

• Issue #3274651 by Wim Leers, nod_, alexpott: Impossible to enable <ol type> or <ul type> with GHS: switch to List's successor, DocumentList
• Issue #3283093 by alexpott, daffie: Update PHP dependencies for minor and patch versions
• Issue #3261447 by xjm, lauriii, ravi.shankar, pingwin4eg, Wim Leers, alexpott, daffie, tedbow: Add an API for dynamically setting recommended and supported PHP versions based on known and predicted PHP release schedules
• Issue #3281578 by Wim Leers, quietone, xjm, catch: Increase Composer dependency constraints to latest minors for forward-compatibility
• Issue #3265140 by Spokje, bnjmnm, lauriii, mstrelan, dww, Wim Leers, xjm, murilohp, daffie: Move QuickEditImageController from image to quickedit
• Issue #3277438 by Wim Leers, bnjmnm, lauriii, xjm, nod_, Reinmar: Update to CKEditor 5 v34.1.0
• Issue #3282342 follow-up: Forward-port Guzzle updates, because the private testrunner doesn't like me today
• Issue #3282395 by alexpott, mallezie: Latest versions of PHPStan and mglaman/phpstan-drupal cannot find PhpUnitVersionDependentTestCompatibilityTrait
• Issue #3282342 by xjm: Forward-port Guzzle updates, because the private testrunner doesn't like me today
• Issue #3281863 by alexpott, Wim Leers, nod_, hestenet, xjm, huzooka, Mixologic: Nightwatch tests failing >50% of test runs on PHP 7.3 in 9.4.x and 9.5.x, as well as PHP 8.1 on 10.0.x
• Issue #3282050 by Spokje: Failing HEAD on PHP 7.3 on ComposerIntegrationTest::testComposerLockHash
• Issue #3279703 by VIGHNESH SADAGOPAL, Binoli Lalani, Stockfoot, Maninders, Ruturaj Chaubey, mherchel, Libbna, ckrina, longwave: Change "Welcome to " to "Welcome!" on the initial install screen
• Issue #3246755 by mherchel, yogeshmpawar, Libbna, cindytwilliams, zenimagine: Olivero main/user account menu layout struggles with long menus
• Issue #3279693 by mherchel, andy-blum: Olivero: Hyperlinks with "button" or "button--primary" do not have proper styling when nested in a "text-content" container
• Issue #2513524 by andregp, JeroenT, Bill Choy, TR, tstoeckler, dawehner, Wim Leers, xjm: ExtensionDiscovery is unable to find modules that have a comment at the end of the type property in a .info.yml file
• Issue #3274080 by mherchel, andy-blum, lauriii: Olivero's mobile menu experience doesn't properly adapt to forced colors
• Issue #3270842 by javi-er, sharayurajput, ckrina, WagnerMelo, saschaeggi: Define Red color scale for Claro
• Issue #3245553 by quietone, danflanagan8: Fix migration of localized D6 menu links
• Issue #2580723 by AdamPS, Berdir, andypost, darvanen, larowlan, alexpott, effulgentsia, catch, dawehner: Fix token system confusion, with new function Token::replacePlain()
• Issue #3270936 by Spokje, quietone, andypost, lauriii: Deprecate Color module
• Issue #3058409 by guilhermevp, joachim, ravi.shankar, quietone, init90, andregp: TermStorage::loadTree() doesn't document what the return array is keyed by
• Issue #3225966 by claudiu.cristea, xjm, Mixologic, neclimdul, alexpott, longwave, Berdir, effulgentsia: Consider loosening our constraint to allow sites to install Guzzle 6 or 7, or otherwise handle PHP 8.1 deprecations for Guzzle 6
• Issue #3280882 by mondrake, mallezie: KernelTestBase::tearDown() cleanup prevents good typehinting practices
• Issue #3262874 by Spokje, longwave, ankithashetty, catch, andypost: Update Coder to 8.3.15
• Issue #3232714 by paulocs, vsujeetkumar, mondrake, longwave, quietone, larowlan: Replace, in tests, mocks that do not configure doubles with their actual objects
• Issue #3268746 by quietone, xjm: Fix missing newlines for 'Drupal.Commenting.DocComment.ShortSingleLine'
• Issue #3272956 by xjm, Wim Leers, tedbow, dww: Hardcode security coverage EOL dates for Drupal 9.4 and 9.5 (as was done for 8.8 and 8.9)
• Issue #3280602 by larowlan, DanielVeza, Wim Leers, mstrelan: Exceptions for CKEditor 5 plugin definitions containing wildcard tags when PHP is built with libxml 2.9.14
• Issue #3250582 by huzooka, Matroskeen, danflanagan8, ravi.shankar, quietone, erik.erskine: ResponsiveImageStyles source plugin must extend DrupalSqlBase
• Issue #3276565 by dww, larowlan: Add larowlan as maintainer of contextual.module
• Issue #3260920 by tstoeckler: Contact's MessageEntityTest wrongly uses 'edit' access operation on entities instead of 'update'
• Issue #332796 by voleger, dww, Steve Dondley, ykhadilkar, Dave Reid, ankithashetty, Anybody, benjifisher, mstrelan, David_Rothstein, phenaproxima, Bojhan: Add permissions to the update.module to hide warnings
• Issue #3112283 by ravi.shankar, mpdonadio, andregp, daffie, jhedstrom, alexpott, andypost, pifagor, vladbo, JeroenT, voleger, cliddell: Replace REQUEST_TIME in non-OO and non-module code
• Issue #2580263 by Berdir, nils.destoop, catch, Cottser, larowlan: Find a way to not run contextual_preprocess() on every template
• Issue #3280614 by Spokje: (Not so) Random test failures QuickEditFileTest
• Issue #3277552 by Hebl, Asha Nair, rootwork, Charles Belov: Seven is missing focus in "Available buttons" and "Active toolbar" within CKEditor toolbar configuration Primary tab
• Issue #3279502 by webflo: Fix invalid @property annotations
• Issue #3218562 by bradjones1, yogeshmpawar, Lendude, catch: Fix typo in/rename SearchSimplifyTest
• Issue #3272581 by danflanagan8: Image tests should not rely on Classy
• Issue #3272336 by danflanagan8: File tests should not rely on Classy
• Issue #3272543 by danflanagan8, larowlan: History tests should not rely on Classy
• Issue #3276652 by andregp, eojthebrave, markie, catch, danflanagan8: AssertMenuActiveTrailTrait should not rely on classy/bartik
• Issue #3279103 by bradjones1: Test cleanup: Remove dead code from JsonApiFunctionalTest
• Issue #3272558 by danflanagan8: Content Translation tests should not rely on Classy
• Issue #3275530 by danflanagan8: Language Tests should not rely on Classy
• Issue #3278314 by acbramley: InlineBlockUsageInterface::getUsage can return FALSE but isn't documented
• Issue #3270081 by franck_lorancy, quietone, Cottser: Fix indentation in doc block \Drupal\Core\Render\RendererInterface::render
• Issue #3276839 by Spokje, mondrake: Remove leftover dumpHeaders property
• Issue #3272354 by danflanagan8: Filter tests should not rely on Classy
• Issue #3277557 by galactus86, mherchel, rootwork: Olivero: Progress indicator percentage label does not have proper spacing
• Issue #3278032 by andregp, bkline@rksystems.com: Remove dead code from ContentTranslationController
• Issue #2314443 by olli, Lendude, immaculatexavier, dawehner: Changing view name does not update page title in views ui
• Issue #2917239 by Lendude, dww, iStryker: Form is built when not using fields
• Issue #3276218 by lauriii: Follow-up to #3268318: Enable link manual decorator unrestricted test case
• Issue #3277311 by nod_, Wim Leers, catch, larowlan: Deprecate and mark internal contextual JS API
• Issue #3252100 by amateescu, catch, Tim Bozeman: Set revision_default when publishing
• Issue #3280359 by bnjmnm: Make jQuery.form internal
• Issue #3279840 by Spokje, mallezie, alexpott: Fix \Drupal\Tests\quickedit\FunctionalJavascript\SettingsTrayIntegrationTest::createBlockContent()
• Issue #3259593 by hooroomoo, Dom., Wim Leers, lauriii: Alignment being available as separate buttons AND in dropdown is confusing
• Issue #3101922 by bnjmnm, nod_, lauriii: Find replacement for Modernizr touchevent test and deprecate
• Issue #3278786 by lauriii, nod_: Update production JavaScript dependencies to latest minors
• Issue #3279850 by alexpott, dww, lauriii: Theme post updates are not recognised when the theme is used in the installer
• Issue #3253286 by lauriii, ckrina, bnjmnm, xjm: Remove unnecessary template overrides and associated code from starterkit theme
• Issue #3206226 by Wim Leers, mglaman, lauriii, alexpott: Make updating changes from starterkit themes to generated themes easier
• Issue #3269657 by hooroomoo, Wim Leers: [drupalMedia] The CKEditor 4 → 5 upgrade path for the media_embed filter should not forcefully allow the `data-view-mode` attribute on ``
• Issue #3278246 by lauriii, alexpott, nod_, justafish: Deprecate core/scripts/js/babel-es6-build.js for removal from 10.0.x
• Issue #3279788 by alexpott: PHP 7.3 testing on Drupal 9.4.x and 9.5.x is broken due to \Drupal\Tests\RequirementsPageTrait::assertRequirementSummaries() assuming Seven is the update.php theme
• Issue #3251709 by cindytwilliams, andregp, ankithashetty, ckrina, saschaeggi: Define Blue scale for Claro
• Issue #3279640 by alexpott, Spokje, mherchel, lauriii, catch: Standard install profile uses Olivero for update.php
• Issue #3253955 by benjifisher, kristiaanvandeneynde, AaronMcHale: Let modules opt in to the bundle-specific permissions form
• Revert "Revert "Issue #3254866 by benjifisher, alexpott: Update the deprecation notices related to "Manage Permissions" pages""
• Revert "Revert "Issue #2934995 by benjifisher, larowlan, paulocs, AaronMcHale, vikashsoni, danflanagan8, Berdir, SKAUGHT, alexpott: Add a "Manage permissions" tab for each bundle that has associated permissions""
• Issue #3275237 by hooroomoo, lauriii, Wim Leers, nod_: Don't convert, instead use response.entity_type in DrupalImageUploadEditing
• Issue #3278394 by Wim Leers, bnjmnm: HTMLRestrictions' diff operation bug: diff(, ) should return an empty result