Drupal Release: 9.4.0

TL;DR

Drupal 9.4.0 introduces significant enhancements to the CMS with Claro becoming the default admin theme and Olivero the default frontend theme. This release brings major improvements to the editorial experience with CKEditor 5 upgrades, better media handling, and accessibility enhancements. The Color module has been deprecated and moved out of the Standard profile, while PHP 7.3 support has been officially dropped. This version also includes numerous bug fixes, performance improvements, and prepares the way for future Drupal 10 compatibility.

Highlight of the Release

• Claro is now the default admin theme in Standard and Umami profiles
• Olivero is now the default frontend theme in Standard profile
• CKEditor 5 improvements including better media handling and table editing
• Color module deprecated and removed from Standard profile
• Official PHP 7.3 support dropped in favor of PHP 7.4+
• New Starterkit theme system for easier theme development
• Improved accessibility throughout admin and frontend interfaces
• Bundle-specific permissions management with new 'Manage permissions' tab
• New loading attribute UI for images to improve performance
• Modernizr touchevents dependency deprecated in favor of more modern approaches

Migration Guide

Upgrading to Drupal 9.4.0

PHP Version Requirements

• PHP 7.3 Support Dropped: Drupal 9.4.0 has officially dropped support for PHP 7.3. Ensure your environment is running PHP 7.4 or higher before upgrading.

Theme Changes

• Default Themes Changed:

  • Claro is now the default admin theme in Standard and Umami profiles
  • Olivero is now the default frontend theme in Standard profile
  • If you were using Bartik or Seven, they are still available but no longer default

• Color Module Deprecated:

  • The Color module has been deprecated and removed from the Standard profile
  • If your site depends on the Color module, you'll need to explicitly enable it after upgrading
  • Consider planning for alternatives as the module will be removed in Drupal 10

CKEditor 5 Upgrade Path

• If upgrading from CKEditor 4:
  • The upgrade path has been improved but review your text formats after upgrade
  • Check text formats with markup language filters enabled as these required special handling
  • If you used the "codetag" contrib CKEditor 4 plugin, a migration path to the built-in equivalent is now available
  • Review any custom CKEditor configurations, especially for media embedding and view modes

JavaScript Dependencies

• Several JavaScript libraries have been deprecated:
  • Modernizr.touchevents: Replace with more modern approaches
  • Backbone: Tagged as internal, avoid direct usage
  • Underscore: Deprecated, plan to replace usage
  • jQuery.form: Marked as internal, avoid direct usage
  • If your custom code relies on these libraries, plan to update your code

Module Updates

• Aggregator Module: Deprecated in Drupal 9.4, plan to migrate away from it
• RDF Module: Tests have been moved in preparation for removal
• Hook Invocations: All hook invocations are now delegated to ModuleHandler

Theme Development

• If developing custom themes:
  • Consider using the new Starterkit theme system
  • Update any code that relied on Classy as many tests no longer depend on it
  • Review theme post update hooks as the system has been extended

Permissions Management

• Bundle-specific permissions are now managed through a dedicated "Manage permissions" tab
• Review your permission management workflows to take advantage of this new feature

Upgrade Recommendations

Recommended Action: Upgrade to Drupal 9.4.0 is recommended for most sites, especially those looking to benefit from the improved admin interface, CKEditor 5 enhancements, and accessibility improvements.

Priority: Medium to High

Preparation Steps:

1. Verify PHP compatibility: Ensure your hosting environment supports PHP 7.4 or higher, as PHP 7.3 support has been dropped.
2. Backup your site: Create a complete backup of your site files and database before upgrading.
3. Test on staging first: Always test the upgrade on a staging environment that mirrors your production site.
4. Review deprecated functionality: Check if your site uses the Color module or any of the deprecated JavaScript libraries.
5. Update contributed modules: Ensure all contributed modules are compatible with Drupal 9.4.

Special Considerations:

• Sites heavily customized with the Color module should plan for its eventual removal in Drupal 10.
• Custom themes based on Bartik or Seven may need updates as these are no longer the default themes.
• Sites with complex CKEditor configurations should carefully test the upgrade to ensure all functionality works as expected.
• Custom code using deprecated JavaScript libraries should be updated to use modern alternatives.

Post-Upgrade Tasks:

1. Clear caches and run update.php
2. Test all forms and content creation workflows
3. Verify that media embedding in CKEditor 5 works correctly
4. Check accessibility of your site in high contrast/forced colors mode
5. Review any custom theme implementations for compatibility with new default themes

Long-term Planning: This release includes several deprecations preparing for Drupal 10. Use this opportunity to begin planning for these changes to ensure a smooth upgrade path to Drupal 10 when it becomes available.

Bug Fixes

CKEditor and Text Editing

• Fixed issue where merging cells in tables was possible in UI but lost upon saving
• Fixed issue where changes to "Manually editable HTML tags" were lost if form submitted without triggering AJAX
• Fixed CKEditor 5 initialization failures with certain configurations of allowed view modes
• Fixed issue where $block wildcard resolved into a superset of the actual $block tags
• Fixed issue where CKEditor 5 plugin definitions containing wildcard tags caused exceptions with certain PHP libxml versions
• Fixed issue where upgrading from CKEditor 4 for text formats with markup language filters enabled caused problems

Theme and UI Issues

• Fixed Olivero's mobile menu experience in forced colors mode
• Fixed Claro's radio buttons and checkboxes in high-contrast/forced colors mode
• Fixed Olivero's breadcrumb divider icon visibility in forced colors
• Fixed Olivero's <details> element rendering in forced colors
• Fixed Olivero's code block styling at various viewport widths
• Fixed issue where messages could be malformed when JS creates messages and PHP messages already exist
• Fixed Olivero's main/user account menu layout with long menus
• Fixed hyperlinks with "button" or "button--primary" styling when nested in "text-content" containers

Form and Validation Issues

• Fixed issue where cancel account button on user form triggered server-side validation
• Fixed issue where form is built when not using fields
• Fixed block add form ajax callback implementation issues
• Fixed Seven theme's focus in "Available buttons" and "Active toolbar" within CKEditor toolbar configuration

Migration and Update Issues

• Fixed issue where system_site migrates default 403, 404, and front page paths as forward slash (/)
• Fixed issue where theme post updates were not recognized when the theme is used in the installer
• Fixed issue where theme's post updates within update.php referred to themes as "module"
• Fixed issue where Standard install profile used Olivero for update.php

Database and Performance Issues

• Fixed issue where ViewsJoin ignored operator in configuration
• Fixed issue where queue items were only reserved by cron for 1 second
• Fixed issue where changing view name did not update page title in views UI

Other Fixes

• Fixed issue where contextual links could break in scenarios with Modernizr.touchevents
• Fixed typo in Block module's tour
• Fixed issue with unrouted URLs error messages
• Fixed issue where ExtensionDiscovery couldn't find modules with comments at the end of type property in .info.yml files
• Fixed database locks on SQLite in Drupal Media JavaScript test suite

New Features

Theme System Improvements

• Claro is now stable and the default admin theme in both Standard and Umami installation profiles, providing a modern, accessible administrative interface.
• Olivero is now the default frontend theme in the Standard installation profile, replacing Bartik.
• New Starterkit theme system allows for easier theme development and updates with:
  • Control over how themes are generated
  • Easier updating of changes from starterkit themes to generated themes
  • Removal of unnecessary template overrides and associated code

CKEditor 5 Enhancements

• Media handling improvements:
  • Support for choosing view modes for <drupal-media> elements
  • Better handling of media alignment options
  • Fixed issues with media view modes when alignment is not enabled
• Table editing improvements:
  • Support for merging cells in tables with proper saving
  • Support for table captions using native CKEditor 5 functionality
• List improvements:
  • Support for <ol start> and <ol reversed> attributes
  • Updated to use DocumentList instead of List for better HTML support
• Image enhancements:
  • Required alt text for images to improve accessibility
  • Migration path for the "codetag" contrib CKEditor 4 plugin to CKEditor 5

User Interface Improvements

• Bundle-specific permissions management with a new "Manage permissions" tab for each bundle that has associated permissions
• New loading attribute UI for images to improve performance with lazy loading options
• Improved dropdown button behavior when text is split across multiple lines
• Non-stable modules are now highlighted on the module uninstall form for better visibility

Accessibility Enhancements

• Improved color contrast throughout Claro and Olivero themes
• Better support for forced colors mode in both themes
• Required image alt text in CKEditor 5 to ensure accessibility compliance
• Consistent navigation fixes for secondary tabs to prevent violations

Security Updates

• Included security fixes from SA-CORE-2022-008, SA-CORE-2022-009, and SA-CORE-2022-011.

Security Improvements

• Required image alt text in CKEditor 5 to improve accessibility and security.
• Restricted allowed additional attributes in CKEditor 5 to prevent self XSS.
• Fixed legacy random session ID generation to be compatible with symfony/http-foundation v4.4.42.
• Added validation for module uninstall validators during config import to prevent security issues.
• Updated Composer dependencies to the latest minor and patch versions to address security vulnerabilities.
• Updated yarn dependencies to address security vulnerabilities.

Security-Related API Changes

• Created a process for reviewing changes in 3rd party JavaScript dependencies to better track security implications.
• Deprecated FilterInterface::getHTMLRestrictions()' forbidden_tags functionality in favor of more secure approaches.

Performance Improvements

Image Loading Performance

• Added UI for the 'loading' HTML attribute for images, allowing site builders to easily implement lazy loading for images which can significantly improve page load performance and reduce bandwidth usage.

JavaScript Optimizations

• Deprecated and marked as internal several JavaScript libraries and APIs to reduce frontend code bloat:
  • Modernizr touchevents test deprecated in favor of more modern approaches
  • Backbone library deprecated and tagged as internal
  • Underscore library deprecated and marked as internal
  • Contextual JavaScript API deprecated and marked as internal
  • jQuery.form marked as internal

Rendering Optimizations

• Improved contextual links rendering by finding a way to not run contextual_preprocess() on every template, reducing unnecessary processing.

Database Improvements

• Fixed an issue where queue items were only reserved by cron for 1 second, which could lead to performance issues with queue processing.

Configuration Management

• Reduced complexity in \Drupal\Core\Site\Settings::initialize for better performance during bootstrap.

Dependency Updates

• Updated JavaScript dependencies to latest versions, which often include performance improvements:
  • Updated to CKEditor 5 v34.1.0
  • Updated jsdom to latest major release
  • Updated production JavaScript dependencies to latest minors

Impact Summary

Drupal 9.4.0 represents a significant step forward in Drupal's evolution, particularly in the areas of user experience, accessibility, and editorial capabilities. The shift to Claro as the default admin theme and Olivero as the default frontend theme modernizes Drupal's appearance and improves accessibility out of the box. These changes align with Drupal's commitment to providing an inclusive experience for all users.

The CKEditor 5 improvements enhance the content editing experience with better media handling, table editing capabilities, and accessibility features like required image alt text. These changes make content creation more intuitive while ensuring accessibility compliance.

For developers, the deprecation of older JavaScript libraries and the introduction of the Starterkit theme system signal Drupal's continued evolution toward modern web standards. The official dropping of PHP 7.3 support pushes the ecosystem toward more secure and performant PHP versions.

Site builders benefit from improved tools like bundle-specific permissions management and better handling of experimental modules. The new loading attribute UI for images provides an easy way to implement performance optimizations.

The deprecation of the Color module and its removal from the Standard profile represents a shift away from in-place theme customization toward more robust theming approaches. While this may require adaptation for some sites, it aligns with best practices for theme development.

Security improvements, including multiple security advisories and better protection against self-XSS, demonstrate Drupal's ongoing commitment to maintaining a secure CMS platform.

Overall, Drupal 9.4.0 delivers meaningful improvements across the board while preparing the way for future compatibility with Drupal 10. The focus on accessibility, modern interfaces, and improved editorial tools makes this a valuable upgrade for most Drupal sites.