Drupal 11.3

Apply the PHP 8.5 baseline first. These rules cover Drupal core 11.3 on PHP 8.5. The line supports PHP 8.3–8.5, but PHP 8.5-only APIs in the baseline do not apply to older runtimes. In 11.3.16, core's dependency constraints include Symfony 7.4 components and Twig ^3.27.0. Database minimums are MySQL 8.0 or MariaDB 10.6 with InnoDB, PostgreSQL 16 with pg_trgm, or SQLite 3.45. Keep this line's behavior distinct from Drupal 10 and Drupal 12.

Release scope and security updates

• On 11.3.0 through 11.3.16, which predate the 11.3.17 fix for SA-CORE-2026-013, the bundled CKEditor has an XSS flaw: anyone who can create or edit content, even without CKEditor access, may be able to run script in the browser of users who edit with CKEditor, including site administrators. Drupal publishes no workaround, so until a fixed 11.3 release is deployed, limit content creation and editing to trusted accounts.
• Run the newest 11.3 release and take each 11.3 security release as it ships, because Drupal delivers security fixes only as new patch releases of the minors it still covers. Don't wait for composer audit to tell you about a core security release: Drupal advisories without a CVE, such as SA-CORE-2026-013, don't reach the advisory data it reads. Keep core's update module enabled with its email notification set to at least security updates, and follow drupal.org's core security announcements.
• Use drupal/core-recommended, review the resolved core and dependency versions in composer.lock, and apply security releases promptly. Do not freeze production at 11.3.16 or assume a