Drupal Release: 11.0.11

TL;DR

Drupal 11.0.11 is a security release that addresses a critical vulnerability in Twig (CVE-2025-24374). It also fixes a random test failure in language negotiation tests. This is a security-focused maintenance release that all Drupal 11 users should apply immediately to protect their sites.

Highlight of the Release

• Security update for Twig addressing CVE-2025-24374
• Fix for random test failures in language negotiation tests
• Minimal changes focused on security and stability

Migration Guide

No migration steps are required for this update. This is a straightforward security and bug fix release that can be applied using standard Drupal update procedures:

1. Back up your database and site files
2. Put the site into maintenance mode
3. Update Drupal core to version 11.0.11
4. Run the database update script if prompted
5. Take the site out of maintenance mode

No configuration changes or special handling is needed after updating.

Upgrade Recommendations

Immediate Update Recommended

This release contains an important security fix for Twig (CVE-2025-24374). All sites running Drupal 11.0.10 or earlier in the 11.x branch should update immediately to ensure site security.

The update process should be straightforward with minimal risk, as this is a targeted security and bug fix release with no API changes or feature additions.

Bug Fixes

Fixed Random Test Failures

• Fixed issue #3496438 where LanguageNegotiationInfoTest::testInfoAlterations would occasionally fail randomly, improving test reliability for language negotiation functionality.

New Features

No new features were introduced in this maintenance release. This update focuses on security and bug fixes.

Security Updates

Twig Security Update

• Updated Twig to address CVE-2025-24374 (Issue #3503195)
• This security vulnerability in Twig could potentially affect template rendering and should be addressed immediately
• The update ensures that template processing remains secure

Performance Improvements

No specific performance improvements were included in this release. The focus was on security updates and bug fixes.

Impact Summary

Drupal 11.0.11 is primarily a security release addressing a vulnerability in Twig (CVE-2025-24374). While the impact on day-to-day site operations should be minimal, the security implications make this an important update to apply promptly.

The fix for random test failures in language negotiation tests improves development reliability but doesn't affect production sites directly.

This release contains minimal code changes (33 additions, 29 deletions across 8 files), indicating a focused update that should present low risk during the upgrade process while providing important security protections.