Drupal for Mac

Security and Dependency Update

• Updated **CKEditor5 from v45.2.0 to v45.2.2** to fix a Cross-Site Scripting (XSS) vulnerability. (Issue #3544581)
• *Note:* While the CKEditor5 XSS vulnerability does not directly affect Drupal core, immediate update is advised if your site enables the **HTML embed plugin** or has a custom plugin using an editable element which implements view **RawElement**.
• Updated to **jQuery 4 RC1**. (Issue #3540886)

Fixed Regressions and Critical Bugs

• Fixed a regression where **"Display the file download URI"** on related file entity shows relative path. (Issue #3253897)
• Fixed an issue where **Functional tests attempting to release locks** for a no-longer existing site throws an exception. (Issue #3540554)
• Fixed an issue where certain **ALTREP objects** could cause RStudio to crash while populating the Environment pane. This fix also resolves duplicates #16445 and #16465. (Issue #16436)
• Fixed an issue where the **default DB transaction isolation** set to read-committed breaks **InstallerIsolationLevelExistingSettingsTest** test. (Issue #3539366)
• Fixed **avif error** $\text{\textemdash}$ "Could not encode image: No codec available". (Issue #3532792)
• Fixed **EntityQueryTest** on SQLite and Postgres. (Issue #3541487)
• Fixed a **random test failure** in `Drupal\Tests\ckeditor5\FunctionalJavascript\MediaLibraryTest`. (Issue #3351597)

API and Developer Improvements/Fixes

• Indicate that **hook\_post\_update\_NAME()** hooks do not run at installation time. (Issue #3530456)
• **hook\_entity\_reference\_selection\_alter()** is now documented. (Issue #3453692)
• **VersionHistoryController** should document its soft expectations. (Issue #3539530)
• **Recipe install command** prints out to stdout and not error, but `RecipeTestTrait::applyRecipe()` only prints out error output. (Issue #3486481)
• Removed remaining usage of **setAccessible()**. (Issue #3540525)
• Cleaned-up deprecated non-standard cast names. (Issue #3540528)
• Fixed deprecated **curl\_close()** for PHP 8.5. (Issue #3541053)
• Fixed deprecated **readdir()** without argument for PHP 8.5. (Issue #3540646)
• Removed duplicate **GenericTest** in system.module. (Issue #3539501)
• The **addComponentToLayout** config action should support adding multiple components. (Issue #3540305)
• The **vendor hardening plugin** should provide a way to skip cleaning certain packages. (Issue #3534278)
• Removed function **block\_themes\_installed()** is still referenced in comments. (Issue #3537396)

Other Fixes and Minor Changes

• Fixed an issue with **malicious fingerprinting of visitors** via role name on content translation screen. (Issue #3440399)
• Fixed **Drupal\comment\Controller\CommentController::getReplyForm()** never returns a response object. (Issue #3536999)
• Used a more standard **transliteration for Cyrillic щ**. (Issue #3215368)
• Fixed an issue where **APCu requirement for 32MB** always displays since APCu 5.1.25. (Issue #3538854)
• Resolved issue where **entity queries querying the latest revision** are very slow with lots of revisions. (Issue #2950869)
• Removed **tedbow** as maintainer for Settings Tray subsystem. (Issue #3537282)