Skip to content

Updated Drupal core to 11.4.7 and contrib modules, closing two security advisories. - #331

Merged
AlexSkrypnyk merged 2 commits into
developfrom
feature/drupal-updates-2026-09-18
Sep 17, 2026
Merged

Updated Drupal core to 11.4.7 and contrib modules, closing two security advisories.#331
AlexSkrypnyk merged 2 commits into
developfrom
feature/drupal-updates-2026-09-18

Conversation

@AlexSkrypnyk

@AlexSkrypnyk AlexSkrypnyk commented Sep 17, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary

This PR closes two published, moderately-critical security advisories outstanding on develop: SA-CORE-2026-013, a Cross-Site Scripting flaw in the CKEditor 5 engine bundled with Drupal core, and SA-CONTRIB-2026-138 (CVE-2026-87940), an access-bypass flaw in drupal/key_auth, the module that authenticates the do_content_api content-authoring endpoints documented in docs/content-api.md.

Both preconditions are met on this site: ckeditor5 is enabled with four configured text formats (basic_html, civictheme_rich_text, full_html, webform_default) in config/default/core.extension.yml, and key_auth runs alongside the enabled dynamic_page_cache module that SA-CONTRIB-2026-138 names as the precondition for one account reading another account's authentication keys.

composer audit --locked reports these two advisories against develop's composer.lock and reports none against this branch's lock, with Drupal core moving 11.4.6 to 11.4.7 and drupal/key_auth moving 2.2.3 to 2.2.4 as the fixes; no extra.patches entry was re-rolled, no config.audit.ignore entries exist, and no file outside composer.json/composer.lock is touched.

Before / After

BEFORE (develop)                              AFTER (this PR)
┌────────────────────────────────────────┐    ┌────────────────────────────────────────┐
│ composer audit --locked                │    │ composer audit --locked                │
│   2 advisories found                   │    │   No advisories found                  │
│                                        │    │                                        │
│ SA-CORE-2026-013                       │    │ drupal/core           11.4.7           │
│   drupal/core          11.4.6          │    │   CKEditor 5 XSS patched               │
│   CKEditor 5 XSS, moderately critical  │ -> │                                        │
│                                        │    │                                        │
│ SA-CONTRIB-2026-138 / CVE-2026-87940   │    │ drupal/key_auth       2.2.4            │
│   drupal/key_auth      2.2.3           │    │   Access bypass patched                │
│   Access bypass, moderately critical   │    │                                        │
└────────────────────────────────────────┘    └────────────────────────────────────────┘

What changed

  • This update closes two published security advisories that were both outstanding on the site, each rated moderately critical: a cross-site scripting flaw in the editor library bundled with the framework, and an access-bypass flaw in the module that authenticates the content API.
  • Drupal core moved from 11.4.6 to 11.4.7, which is the release carrying the editor security fix rather than a routine maintenance drop.
  • After the update the dependency audit reports "No security vulnerability advisories found", down from two.
  • The Symfony components underpinning the request, mail and serialisation stack moved from the v7.4.15-v7.4.18 range to v7.4.19, all patch releases.
  • Risk of regression is low despite the security content: no major version jumps, no package removals, and every patch already carried by the project still applied without a re-roll.

Key highlights

  • Drupal core is now 11.4.7, up from 11.4.6, which is the release that patches the bundled editor library.
  • drupal/key_auth is now 2.2.4, which patches the access bypass affecting authentication keys.
  • The Symfony 7.4 LTS components converge on v7.4.19 across console, finder, HTTP foundation, HTTP kernel, mailer, MIME, process, serializer, string and validator.
  • The HTTP and API stack picks up symfony/http-client v6.4.46 and openai-php/client v0.21.0, with drupal/ai at 1.4.9.
  • Content-editing and authoring surfaces update through drupal/linkit 7.0.17, drupal/entity_usage 2.3.0, drupal/views_bulk_operations 4.4.8 and drupal/key_auth 2.2.4.
  • Developer tooling advances with drush/drush 13.8.0, behat/behat v3.33.0, phpstan/phpstan 2.2.14, mglaman/phpstan-drupal 2.2.0, vincentlanglet/twig-cs-fixer 4.1.1 and ergebnis/composer-normalize 2.53.0.

Testing focus

  • Sign in as an administrator and confirm the admin interface and content listings load without error.
  • Open a page that uses each rich-text format, confirm the editor toolbar loads and every button works, then save and confirm the markup round-trips unchanged.
  • Send a request to the content authoring API with a valid key and confirm it is accepted; repeat with a missing or altered key and confirm it is rejected.
  • Submit the site's contact form and confirm the notification email is delivered and correctly addressed.
  • Insert an internal link through the editor's link picker and confirm the autocomplete suggests content and the saved link resolves.
  • Run a bulk publish or unpublish from a content listing and confirm only the selected items change state.
  • Open the usage report for a media item and confirm the pages referencing it are listed.
  • Load a handful of published pages as an anonymous visitor and confirm caching, the XML sitemap and the security headers all still respond.

Overall impact

This is a security update wearing the clothes of a routine one. Every package moved within its existing major version, so no interfaces were withdrawn and no migration work is implied, but two of those small version moves each close a published vulnerability that applied to this site as configured.

The first affects the rich-text editor. A contributor able to create or edit content could use it to attack anyone who later opened that content in the editor, including administrators. The second affects the module that authenticates the content API, where one account could read another account's API keys. Neither is theoretical here: the site runs the configuration each advisory names as the precondition. This should be deployed promptly rather than held for the next cycle.

Expected regressions are minimal. The areas most worth a look after deployment are the rich-text editor, authenticated API access, editorial linking and bulk content operations, since those are the surfaces whose supporting code moved. Everything else is transitive library maintenance that should be invisible to visitors and editors alike.

Changes

Checklist before requesting a review

  • Subject includes ticket number as [#123] Verb in past tense.
  • Ticket number #123 added to description
  • Added context in Changed section
  • Self-reviewed code and commented in commented complex areas.
  • Added tests for fix/feature.
  • Relevant tests run and passed locally.

Screenshots

N/A - dependency-only change (composer.json and composer.lock), nothing user-visible to capture.

Summary by CodeRabbit

  • Maintenance
    • Updated the Drupal platform and supporting packages to newer patch and minor releases.
    • Updated authentication, content management, command-line, HTTP, testing, and code-quality tooling components.

@coderabbitai

coderabbitai Bot commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: fcbbd6ad-96d0-47a5-8e01-20306adf8b2e

📥 Commits

Reviewing files that changed from the base of the PR and between 43eb806 and d7c2263.

⛔ Files ignored due to path filters (1)
  • composer.lock is excluded by !**/*.lock
📒 Files selected for processing (1)
  • composer.json

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📝 Walkthrough

Walkthrough

The pull request updates Composer constraints for Drupal core, contributed modules, runtime packages, testing tools, static analysis tools, and coding tools.

Changes

Composer Dependency Updates

Layer / File(s) Summary
Update Composer dependency constraints
composer.json		 Updates Drupal core, contributed module, runtime, testing, static analysis, Composer, and Twig CS Fixer constraints.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to d7c22

The dependency update is mergeable with no confirmed current-head risk; normal install and test checks should still run.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the primary changes: the Drupal core and contributed module updates, including the security advisory fixes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

AlexSkrypnyk
AlexSkrypnyk commented Sep 17, 2026
View reviewed changes
Comment thread composer.json
"drupal/config_update": "^2@alpha",
"drupal/core-composer-scaffold": "~11.4.6",
"drupal/core-recommended": "~11.4.6",
"drupal/core-composer-scaffold": "~11.4.7",

@AlexSkrypnyk AlexSkrypnyk Sep 17, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SA-CORE-2026-013: https://www.drupal.org/sa-core-2026-na0isdadth
SA-CONTRIB-2026-138 / CVE-2026-87940: https://www.drupal.org/sa-contrib-2026-xa9cdychdu

Two of the constraint bumps in this file are security fixes, and both advisories were live against this site rather than theoretical.

drupal/core-recommended and drupal/core-composer-scaffold move ~11.4.6 to ~11.4.7, the release that patches a moderately-critical XSS in the bundled CKEditor 5 engine. The advisory's wording is what makes it matter here: "an attacker that can create or edit content (even without access to CKEditor themselves)" can target anyone who later opens that content in the editor, including administrators. This site is in scope - ckeditor5 is enabled in config/default/core.extension.yml and four formats configure an editor (basic_html, civictheme_rich_text, full_html, webform_default).

drupal/key_auth moves ^2.2.3 to ^2.2.4, patching an access bypass where the module omitted per-user caching and one account could read another account's authentication keys. The advisory notes exploitation requires dynamic_page_cache, which it treats as a non-default mitigation - but on this site that module is enabled alongside key_auth, so the precondition is met. key_auth is what authenticates the do_content_api endpoints described in docs/content-api.md, so the keys at risk are the ones used to post content.

The remaining constraints moved because config.bump-after-update is true, so Composer rewrites the floor to whatever the lock resolved - that is why this file changed at all rather than only composer.lock. Worth a reviewer's attention among them:

  • mglaman/phpstan-drupal ^2.1.2 to ^2.2.0 made five previously always-on legacy rules configurable and corrected a wrong error identifier, either of which can shift what static analysis reports. Verified locally: ahoy lint is green, with PHPStan and Rector both reporting no errors, so no baseline or config change was needed.
  • behat/behat ^3.32.0 to ^3.33.0 adds Cucumber tag expressions - the reason cucumber/tag-expressions appears as a new lock entry with no matching line here, since it is a transitive dependency. It also adds a deprecation when a step definition's parameter count disagrees with its function signature, and fixes scenarios that failed only inside a hook never being re-run, so a previously-hidden failure can surface in CI.
  • drupal/entity_usage ^2.2@beta to ^2.3@beta is the only minor contrib bump. drush updatedb:status reports no database updates required, so it ships nothing this site has to run on deploy.

No extra.patches entry needed re-rolling - all six patches still apply, and patches.lock.json is unchanged. There is no config.audit.ignore block in this file, so nothing was pruned there. composer audit --locked reports these two advisories against the develop lock and none against this branch.

@AlexSkrypnyk
AlexSkrypnyk enabled auto-merge (squash) September 17, 2026 21:25
@AlexSkrypnyk AlexSkrypnyk added the AUTOMERGE Pull request has been approved and set to automerge label Sep 17, 2026
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown

Code coverage (threshold: 80%)

  Classes: 51.85% (14/27)
  Methods: 77.17% (71/92)
  Lines:   89.16% (757/849)
Per-class coverage 
Drupal\do_ai_alt_text\AltTextGenerator
  Methods:  85.71% ( 6/ 7)   Lines:  98.72% ( 77/ 78)
Drupal\do_ai_alt_text\Plugin\Action\RegenerateImageAltText
  Methods: 100.00% ( 8/ 8)   Lines: 100.00% ( 63/ 63)
Drupal\do_base\EventSubscriber\PreviewLinkCacheSubscriber
  Methods:  33.33% ( 1/ 3)   Lines:  11.11% (  1/  9)
Drupal\do_base\EventSubscriber\ThemeColorSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  40.00% (  4/ 10)
Drupal\do_base\Hook\AutomatedListPagerHook
  Methods: 100.00% ( 5/ 5)   Lines: 100.00% ( 31/ 31)
Drupal\do_base\Hook\LibraryInfoAlterHook
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% (  9/  9)
Drupal\do_base\Hook\MetatagsAlterHook
  Methods: 100.00% ( 7/ 7)   Lines: 100.00% ( 58/ 58)
Drupal\do_base\Hook\PageAttachmentsHook
  Methods:  87.50% ( 7/ 8)   Lines:  94.92% ( 56/ 59)
Drupal\do_base\NavigationScriptHash
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% ( 27/ 27)
Drupal\do_base\Twig\ImageDimensionsExtension
  Methods:  40.00% ( 2/ 5)   Lines:  81.48% ( 44/ 54)
Drupal\do_content_api\EventSubscriber\JsonApiWriteGateSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  88.89% (  8/  9)
Drupal\do_content_api\Hook\EntityCreateAccessHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 12/ 12)
Drupal\do_content_api\Hook\ModerationPolicyHook
  Methods:  50.00% ( 1/ 2)   Lines:  93.75% ( 15/ 16)
Drupal\do_content_api\Routing\RouteSubscriber
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  6/  6)
Drupal\do_feed\FeedUrlBuilder
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 18/ 18)
Drupal\do_feed\Form\FeedSettingsForm
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 15/ 15)
Drupal\do_feed\Hook\EntityDeleteHook
  Methods:  50.00% ( 1/ 2)   Lines:  92.31% ( 12/ 13)
Drupal\do_feed\Hook\EntityPresaveHook
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 54/ 54)
Drupal\do_feed\Hook\PreprocessParagraphHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 14/ 14)
Drupal\do_feed\Hook\PreprocessViewsViewRowRssHook
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  3/  3)
Drupal\do_feed\Hook\ViewsPreViewHook
  Methods:  50.00% ( 1/ 2)   Lines:  96.43% ( 27/ 28)
Drupal\do_generated_content\Generator\CaseMatrix
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% ( 12/ 12)
Drupal\do_generated_content\Generator\RelativeDate
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  1/  1)

@codecov-commenter

codecov-commenter commented Sep 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.56%. Comparing base (43eb806) to head (d7c2263).

Additional details and impacted files 
@@           Coverage Diff            @@
##           develop     #331   +/-   ##
========================================
  Coverage    86.56%   86.56%           
========================================
  Files           28       28           
  Lines          655      655           
========================================
  Hits           567      567           
  Misses          88       88

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@AlexSkrypnyk
AlexSkrypnyk merged commit 4c5cbd7 into develop Sep 17, 2026
11 checks passed
@AlexSkrypnyk
AlexSkrypnyk deleted the feature/drupal-updates-2026-09-18 branch September 17, 2026 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@AlexSkrypnyk AlexSkrypnyk

Labels

AUTOMERGE Pull request has been approved and set to automerge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AlexSkrypnyk @codecov-commenter