Drupal Release: 8.0.0-beta13

TL;DR

Drupal 8.0.0-beta13 brings significant improvements to caching, performance, and security. This release focuses on enhancing the developer experience with better APIs, fixing critical bugs, and improving the admin UI. Key changes include making block context faster, upgrading to PHP 5.5.9 minimum requirement, implementing a new block layout design, and adding comprehensive cacheability metadata handling. The release also includes numerous bug fixes, security improvements, and code refactoring to prepare for a more stable Drupal 8.

Highlight of the Release

• Minimum PHP version requirement raised to 5.5.9
• New block layout design with improved UI for placing blocks
• Comprehensive improvements to caching architecture with better cacheability metadata
• Enhanced security with better XSS protection and cookie handling
• Improved Views integration for datetime fields
• Better handling of configuration translation
• Fixed critical issues with entity queries and form handling

Migration Guide

PHP Version Requirement

• The minimum required PHP version has been raised to 5.5.9. Ensure your hosting environment meets this requirement before upgrading.

Deprecated Functions

• Several functions have been marked as @deprecated for Drupal 9.x:
  • db_*() wrappers in database.inc
  • entity_get_bundles()
  • comment_view() and comment_view_multiple()
  • file_stream_wrapper_get_*() and file_get_stream_wrappers()

Form State Changes

• Support for $form_state->setCached() for GET requests has been removed. Update any code that relies on this functionality.

Block Context Changes

• If you've implemented custom block context handling, you'll need to update your code to use the new ContextManager instead of the onBlock event.

Entity Form Interface Changes

• EntityFormInterface::validate() has been removed, and button-level validation is no longer used by default in entity forms. Update your form validation code accordingly.

Field API Changes

• If you're working with translated fields, be aware of fixes to ContentEntityBase::getTranslatedField and ContentEntityBase::__clone that affect field references to parent entities.

Migration Module Changes

• Module-specific migration support has been moved into individual modules. If you're working with migrations, check the appropriate module for your migration code.

Upgrade Recommendations

This beta release contains significant improvements to caching, performance, and security, making it a worthwhile upgrade for development sites. However, as this is still a beta release, it is not recommended for production sites.

For Development Sites:

• Upgrade is recommended to test the new features and provide feedback
• Pay special attention to caching behavior changes and the new block layout UI
• Test thoroughly with your custom and contributed modules

For Production Sites:

• Continue using the most recent stable release
• Wait for the official stable release of Drupal 8.0.0
• Use this time to plan your migration strategy and test on development environments

Before Upgrading:

1. Ensure your hosting environment meets the new PHP 5.5.9 minimum requirement
2. Back up your database and files
3. Review the full list of changes to identify potential impacts on your custom code
4. Test thoroughly in a development environment before considering any production deployment

Bug Fixes

Critical Bug Fixes

• Fixed nested condition groups in entity queries that were broken
• Resolved issues with Views editing that caused uncaught exceptions
• Fixed information disclosure/open redirect vulnerability via blocks containing forms
• Addressed issues with machine name inputs not working properly
• Fixed autocomplete functionality that was broken due to missing JavaScript

Entity and Field Handling

• Fixed ContentEntityBase::getTranslatedField and ContentEntityBase::__clone that broke field reference to parent entity
• Resolved issues with entity reference selection with autocomplete widget
• Fixed slow query in NodeRevisionAccessCheck
• Addressed issues with field UI and translation overview

Form and UI Issues

• Fixed machine name inputs regression
• Resolved issues with selecting too many files with JS off causing WSOD with data loss
• Fixed various UI problems with autocomplete select control
• Addressed issues with radios/checkboxes inside fieldset/fieldgroup
• Fixed empty path on search pages settings leading to infinite redirection loop

New Features

Enhanced Caching Architecture

• Added centralized container invalidation method
• Improved cacheability metadata handling with better context bubbling
• Made CSRF links cacheable for better performance
• Added cache tag support for entity translations

Improved Block Management

• Implemented new block layout design to emphasize the primary interaction of placing a block
• Made block context faster by removing onBlock event and replacing it with loading from a ContextManager
• Fixed issues with block visibility settings and documentation

Better Configuration Management

• Added support for plural sources/targets in configuration translation UI
• Exposed field storage configuration to config translation UI
• Improved handling of config overrides with cacheability metadata

Developer Tools

• Included Symfony PSR-7 bridge library
• Added polyfill for date input type
• Added assertions to Drupal test tools
• Updated Guzzle, Goutte, and Mink-Goutte-Driver to latest releases

Security Updates

XSS Protection Improvements

• Fixed role name unescaped on block admin via JavaScript
• Added test for XSS filtering of slogan in SystemBrandingBlock
• Improved handling of SafeMarkup::set() in various components
• Fixed inline templates that were XSS filtered incorrectly
• Addressed issues with local tasks, actions, and contextual links marking strings from derivatives as safe

Session and Cookie Security

• Fixed issue where www. was being stripped from cookie domain by default, which leaked session cookies to subdomains
• Improved handling of redirect responses to make external URIs opt-in
• Enhanced security for form submissions and CSRF protection

Input Validation

• Fixed filter to allow plus sign in email addresses
• Improved handling of user input in various forms
• Enhanced validation for machine names and other user inputs

Performance Improvements

Caching Optimizations

• Made block context faster by removing onBlock event and replacing it with loading from a ContextManager
• Optimized Cache::merge() to accept only 2 instead of N arguments for better performance
• Improved handling of cacheability metadata to reduce unnecessary processing
• Only sending cache context/tags if frontend proxy exists
• Avoided unnecessary cache tag invalidations in ConfigEntityBase

Database and Query Improvements

• Further optimized RouteProvider for better performance with large number of path parts
• Fixed dblog to properly log MAX_ALLOWED_PACKET errors
• Improved entity query performance with better condition handling
• Reduced number of t() calls in LanguageManager() on every request (from ~50 calls for two strings)

JavaScript and Asset Handling

• Improved handling of JavaScript settings for better performance
• Enhanced CSS handling and optimization
• Moved search.admin.css into Seven theme for better organization
• Moved normalize.css loading to Classy theme instead of all themes

Impact Summary

Drupal 8.0.0-beta13 represents a significant step forward in the Drupal 8 development cycle, focusing on stabilizing core APIs, improving performance, and enhancing security. The release introduces comprehensive improvements to the caching architecture, making it more robust and efficient with better handling of cacheability metadata.

The minimum PHP version requirement has been raised to 5.5.9, allowing Drupal to leverage newer language features and maintain better security. This change aligns with PHP's own support lifecycle and ensures Drupal 8 is built on a solid foundation.

For site builders, the new block layout design provides a more intuitive interface for placing blocks, addressing long-standing usability issues. The improved Views integration for datetime fields enhances content display capabilities, while better configuration translation support makes multilingual sites more manageable.

Developers will benefit from numerous API improvements, including the addition of the Symfony PSR-7 bridge library, better error handling, and more consistent entity APIs. Many functions have been marked as deprecated for Drupal 9.x, providing a clear upgrade path for the future.

Security has been enhanced with better XSS protection, improved cookie handling, and fixes for potential information disclosure vulnerabilities. Performance optimizations throughout the codebase ensure Drupal 8 will run efficiently in production environments.

This beta release fixes over 100 issues, including critical bugs in entity queries, Views editing, and form handling, making it significantly more stable than previous betas. While still not recommended for production sites, this release provides a solid foundation for testing and development as Drupal 8 moves closer to a stable release.