Drupal 11.4.5

TL;DR: Drupal 11.4.5 dropped on August 6, 2026, and it's a patch release with actual teeth — an HTML injection fix in ajax_page_state, SQLi protections on the deprecated pgsql entity query class, a Toolbar regression squashed, and a Twig 3.28 bump. It's a bugfix release, it's production-ready, and honestly? You should probably update this week. Security coverage for the 11.4.x line runs until June 2027, so staying current is the whole game.

What's Actually in the Box

Patch releases are supposed to be boring. Drupal 11.4.5 is… mostly boring, in the good way — but there are two fixes in here that make me want your attention before you yawn and close the tab.

• fix: HTML injection in ajax_page_state GET parameter (#3603762) — this is the one that matters. An attacker-controlled GET parameter could smuggle HTML into the page state. It's the kind of thing that sounds academic until someone weaponizes it.
• fix: SQLi protections for the deprecated pgsql entity query condition class (#3614837, 11.x only) — the old Postgres entity query path gets hardened. If you're on a legacy codebase that still touches that class, this patch is your friend.
• fix: Entity query __toString() doesn't invoke query alter hooks (#3593346) — a correctness fix that'll save someone a truly baffling debugging session.
• fix: Toolbar regression with Default Admin (#3612540) — the toolbar broke for default admin setups in the last round; this restores the old behavior.
• task: Update to Twig 3.28 (#3614340) — template engine bump, keeping the ecosystem current.
• fix: Workspace purge deletes entities that went live through another workspace (#3611989) — ouch, this one was nasty for anyone running content staging across workspaces. Purge no longer nukes entities that published through a different workspace.

The Security Bits (Read This)

I'm not going to spin you — the HTML injection fix and the SQLi hardening are the reasons this release exists ahead of schedule. Drupal's security team has been on a tear this cycle, and 11.4.5 reads like a "patch the holes before they become incidents" release. If you're the person who deferred the last couple of point releases because "it's just bugfixes", this is the one where deferring starts to feel like a choice you don't want to explain later.

Fixes That'll Save You a Ticket

Beyond the security stuff, the quality-of-life wins are real. The Toolbar regression fix means admin users on default configs get their sanity back. The workspace purge fix is the one I'd flag for anyone running multi-workspace content workflows — that bug could delete content that was legitimately published through another workspace, which is a data-loss scenario dressed up as a bugfix. And the Twig bump keeps your template layer from drifting too far behind the ecosystem.

How to Actually Upgrade

Composer users, the incantation is:

composer update "drupal/core-*" --with-all-dependencies

Or pin explicitly if that's your style:

composer require drupal/core-recommended:11.4.5 drupal/core-composer-scaffold:11.4.5 drupal/core-project-message:11.4.5 --update-with-all-dependencies

Run your test suite after — the entity query alter-hook fix and the workspace purge change are exactly the kind of behavior shifts that break assumptions in custom modules. Then clear caches and watch for the usual suspects (toolbar, ajax forms, anything that touches ajax_page_state).

Bottom line: 11.4.5 is a small release with two security fixes you don't want to sit on and a couple of genuinely important bugfixes. It's a patch release — low drama, production-ready, update this week. Don't be the person who finds out about the HTML injection fix from a security advisory instead of this changelog.