Drupal 10.6

Apply the PHP 8.4 baseline first. These rules describe the APIs and defaults of Drupal core 10.6, which supports PHP 8.1–8.4, with PHP 8.4 recommended; PHP 8.5 is outside this line's supported matrix. In 10.6.16, core's Composer constraints require Symfony 6.4 and Twig ^3.28.0. Do not import Drupal 11 APIs or module lifecycle assumptions.

Release scope and security updates

• On 10.6.0 through 10.6.16, which predate the 10.6.17 fix for SA-CORE-2026-013, the bundled CKEditor has an XSS flaw: anyone who can create or edit content, even without CKEditor access, may be able to run script in the browser of users who edit with CKEditor, including site administrators. Drupal publishes no workaround, so until a fixed 10.6 release is deployed, limit content creation and editing to trusted accounts. Updating Symfony or Twig alone does not update the bundled CKEditor assets.
• Run the newest 10.6 release and take each 10.6 security release as it ships, because Drupal delivers security fixes only as new patch releases of the minors it still covers, and 10.6 is covered only until Drupal 10's end of life. Don't wait for composer audit to tell you about a core security release: Drupal advisories without a CVE, such as SA-CORE-2026-013, don't reach the advisory data it reads. Keep core's update module enabled with its email notification set to at least security updates, and follow drupal.org's core security announcements.
• Use drupal/core-recommended and update the core packages together with their dependencies; verify the deployed core version, lockfile, and deployed frontend