Backdrop CMS releases

Security release for Backdrop CMS. This release fixes 3 security vulnerabilities:

• BACKDROP-SA-CORE-2026-001
• BACKDROP-SA-CORE-2026-002
• BACKDROP-SA-CORE-2026-003

And includes one security hardening:

• BACKDROP-SA-CORE-2026-004

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

Changes since 1.33.1

Bug Fixes

• Add user role update dependencies to fix upgrade test cases. #7086
• Stop run-tests.sh script from truncating simpletest result files. #7000
• CKEditor should warn if database does not support utf8mb4. #6891
• Exclude comments in listings from disabled content types. #7052
• Fix strtotime() on NULL when rendering empty value in views. #6727
• Properly follow Views Show All/Show None setting. #5729
• Fix responsive tables in Basis, Bartik, Stark themes. #7100

Documentation Updates

• Fix reference to Drupal in file admin. #7074
• Fix typo on file types form. #7073
• Link to a more helpful page on backdropcms.org for updates #6951

Tasks

• Update GitHub actions to their latest versions. #7088
• Switch to separate dedicated cspell repository. #6280

Security release for Backdrop CMS. This release fixes 3 security vulnerabilities:

• BACKDROP-SA-CORE-2026-001
• BACKDROP-SA-CORE-2026-002
• BACKDROP-SA-CORE-2026-003

And includes one security hardening:

• BACKDROP-SA-CORE-2026-004

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

This release contains the security fixes only and no other changes.

Maintenance release for Backdrop CMS. This update contains bug fixes and usability improvements only. This release focuses on fixing regressions found in the 1.33.0 release.

Notes for updating

• It is not necessary to run the update script (located at /core/update.php) for this release.
• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.

Changes since version 1.33.0

Bug fixes

• Call to undefined function cache() in system_list() error on PHP 7.1 #7061
• Regression when contrib modules call _field_filter_items() #7058
• Regression when contrib modules call text_field_is_empty() with only 2 parameters #7057
• Layout additional paths are displayed as overrides even if they're not, in some cases #7053
• Taxonomy term pages with image put image at bottom of page for only 1 or 2 items with that term #7060

Miscellaneous changes

• Improve dropdown menu labels for touch/click behavior #4253
• The page content type now defaults to not having scheduling on new installs #3795

The Backdrop community is proud to release version 1.33.0 of Backdrop CMS, following our 4-month release cycle. This release also marks the 11th birthday of Backdrop CMS! 🎉 🎂

Notes for updating

• It will be necessary to run the update script (located at /core/update.php) for this release.
• No significant changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
  • Note: we have fixed a typo in settings.php

Changes since version 1.32.2 are listed below.

New features

• PHP 8.5 Support #7008
• Update CKEditor5 to version 47.3.0 #7019
• Allow a layout to be selected on multiple paths. #1528
• Add option to select all items across all pages for Views bulk operations #3798
• Add option to disable comments entirely per content type. #3016
• List modules requiring updates to run on Status report #7010
• Add an API and documentation for _config_static cache() #7009

Bug fixes

• Fixed: Custom Text format with multi-value field creates empty field each time after saving node #6987
• Fixed: Minor typo in settings.php. #7013

Additionally, people upgrading from Backdrop 1.32.1 will also receive the following bug fixes (these are also included in Backdrop 1.32.2):

Bug fixes since 1.32.1

• Bad variable name and two typos in ConfigDatabaseStorage #7051
• Regression: Type error in views with view of nodes #7039
• Cannot designate a 'primary' or 'danger' form action unless both are specified #7023
• View Table Headings Slightly Skewed if sticky headers used and active #7017
• CKEditor emoji button broken since switching from DLL to dist #7014
• Redirect references nonexistent default_status_code config value on fresh installs #7006
• Fragment identifiers on Modules page and Permission page don't work #7004
• Fix timezone field length on registration form #7003
• Document hook_menu_block_tree_alter() #6992
• Sites upgraded from Drupal 7 to Backdrop missing _config_static true in JSON files. #6982
• Fixes for transparency with Webp and Gif images. #6978
• Using Layout template "Manual installation" link throws fatal error #6875
• PHP date formats page has moved, update links in description #6812
• Modules admin page can't check if hidden modules are enabled or not #6776
• Typo in views_ui.admin.inc: "as been cloned" #6739
• Wrong php.net link in date_views_filter_handler_simple.inc #6682
• Logo and favicon when uploaded must go into public folder even when default download method is private #6380
• No validation for the "Block content" field when making a custom content block reusable. #6247
• #default_value may or may not work in #options for radios depending on PHP version, option order, and/or key of 0 #6024
• Deprecation notice in bootstrap.inc when bootstrapping from CLI #5844

Documentation updates

• Document why the backdrop_install_schema('system') in system_install() is necessary #5997

Miscellaneous changes

• tableselect.js: trigger a 'change' event when the table heading checkbox is checked or uncheck programmatically. #7040
• Account for latest release of phpcs in our GHA workflow #6973
• Add Manage layouts link to Content type and Taxonomy blocks for the dashboard. #6719
• Remove file.admin.js and deprecate theme_file_display_order(), since they are not being used in Backdrop #6582

Maintenance release for Backdrop CMS. This update contains bug fixes and usability improvements only.

Notes for updating

• It will be necessary to run the update script (located at /core/update.php) for this release.
• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.

Changes since version 1.32.1

Bug fixes

• Bad variable name and two typos in ConfigDatabaseStorage #7051
• Regression: Type error in views with view of nodes #7039
• Cannot designate a 'primary' or 'danger' form action unless both are specified #7023
• View Table Headings Slightly Skewed if sticky headers used and active #7017
• CKEditor emoji button broken since switching from DLL to dist #7014
• Redirect references nonexistent default_status_code config value on fresh installs #7006
• Fragment identifiers on Modules page and Permission page don't work #7004
• Fix timezone field length on registration form #7003
• Document hook_menu_block_tree_alter() #6992
• Sites upgraded from Drupal 7 to Backdrop missing _config_static true in JSON files. #6982
• Fixes for transparency with Webp and Gif images. #6978
• Using Layout template "Manual installation" link throws fatal error #6875
• PHP date formats page has moved, update links in description #6812
• Modules admin page can't check if hidden modules are enabled or not #6776
• Typo in views_ui.admin.inc: "as been cloned" #6739
• Wrong php.net link in date_views_filter_handler_simple.inc #6682
• Logo and favicon when uploaded must go into public folder even when default download method is private #6380
• No validation for the "Block content" field when making a custom content block reusable. #6247
• #default_value may or may not work in #options for radios depending on PHP version, option order, and/or key of 0 #6024
• Deprecation notice in bootstrap.inc when bootstrapping from CLI #5844

Documentation updates

• Document why the backdrop_install_schema('system') in system_install() is necessary #5997

Miscellaneous changes

• tableselect.js: trigger a 'change' event when the table heading checkbox is checked or uncheck programmatically. #7040
• Account for latest release of phpcs in our GHA workflow #6973
• Add Manage layouts link to Content type and Taxonomy blocks for the dashboard. #6719
• Remove file.admin.js and deprecate theme_file_display_order(), since they are not being used in Backdrop #6582

Maintenance release for Backdrop CMS. This update contains bug fixes and usability improvements only.

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php
• The database update script does not need to be run.

Changes since version 1.32.0

Bug fixes

• Fixed Regression: new book cache causes update error when upgrading from D7 #6974
• Fixed Regression: latest core versions break Global Redirect causing redirect loops. #6972
• Fixed Regression: Various problems with the image display after the update to 1.31.1 and 1.32.0 #6969
• Fixed fatal errors on update.php that leaves site in maintenance mode. #6965
• Fixed Views pager fatal error on PHP 8+. #6926
• Fixed fatal error when creating Reusable Custom Blocks with duplicate machine names. #6912

User Experience Improvements

• Add help text to project installer browser. #6936
• Improve Admin bar second and third level menu items on smaller devices. #6916

Miscellaneous changes

• Replace default tablesort icons with SVGs. #6779
• Replace Seven theme tablesort icons with SVGs. #5865

Maintenance release for Backdrop CMS. This update contains bug fixes only.

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php
• The database update script does not need to be run.
• It will be necessary to run the update script (located at /core/update.php) for this release.

Changes since version 1.31.1 are listed below.

Bug fixes

• Fixed Regression: new book cache causes update error when upgrading from D7 #6974
• Fixed Regression: latest core versions break Global Redirect causing redirect loops. #6972
• Fixed Regression: Various problems with the image display after the update to 1.31.1 and 1.32.0 #6969

The Backdrop community is proud to release version 1.32.0 of Backdrop CMS, following our 4-month release cycle.

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• It will be necessary to run the update script (located at /core/update.php) for this release.
• Sites using CKEditor 5 with themes that have a ckeditor5.css stylesheet may need to update the theme (or rename the file in custom themes) due to a filename clash with the newer release of CKEditor 5. One example is the Gin admin theme (which has an update available).

Changes since version 1.31.0 are listed below.

New features

• Add responsive behavior with settings for the existing Views grid style. #5719
• Add the option to append original sort order to Views table column sort. #6708
• Update to latest version of CKEditor 5 (now v46.0.2) including a backwards-compatibility layer for existing Backdrop plugins. #6904
• Entity's label() method now uses the 'label callback' property to allow more flexibility. #6877
• Allow modules and themes to be enabled via config sync / import. #5163
• Increase performance with cache bin for Book navigation data #6787

User Experience Improvements

• Switch the password reset form to use the same FAPI element as creating new, or editing existing accounts. #4440

Additionally, users upgrading from Backdrop 1.31.0 will also have the following bug fixes (which were also included in the recent Backdrop 1.31.1 release):

Bug Fixes

• PHP 8+ Example for hook_user_presave causes Deprecation notice if data field is NULL or FALSE #6943
• Display translated system.core configuration values #6941
• Trusted host settings handling - multiple issues #6935
• If theme sets font size of input.form-search then Admin Bar Menu Search is affected #6925
• Using multiple file browsers on a single node form breaks functionality #6924
• Filter module never cleans up filter section in config leading to PHP warnings #6920
• Reset field types when new modules are installed to ensure potential new field types are immediately available #6919
• Minimum PHP version isn't consistently updated to 7.1 #6914
• Pre-existing field with reserved entity machine name re-used on entity type causes fatal error when adding entity #6900
• Undefined array key when getting the missing callback error in layouts #6885
• Add missing Excel Template (xlsb) MIME types so files show correct icons. #6882
• Removed unnecessary duplication in _entityreference_autocomplete_validate() #6879
• Fixed: Form for "Manage file display" attempts to load all field formatter forms (elements) #6578
• node_access filters out accessible nodes when node is left joined #6421
• Date module datestamp field type affected by Y2K38 #6307
• Alias malfunction when two pages have the same title in multi-language installation #5947
• Prevent translation tests from running before semaphore table is available #5943
• Fixed: Language prefixes are being repeated in Link module fields #4984
• Update the part in the documentation comment about array_filter #6303
• Correct a comment in backdrop_settings_initialize() #6663
• Remove direct use of new Node() and other direct instantiations of entity classes from the codebase #6075

Maintenance release for Backdrop CMS. This update contains bug fixes and usability improvements only.

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• It will be necessary to run the update script (located at /core/update.php) for this release.

Changes since version 1.31.0 are listed below.

UX Improvements

• Display translated system.core configuration values #6941
• If theme sets font size of input.form-search then Admin Bar Menu Search is affected #6925

Bug fixes

• PHP 8+ Example for hook_user_presave causes Deprecation notice if data field is NULL or FALSE #6943
• Trusted host settings handling - multiple issues #6935
• Using multiple file browsers on a single node form breaks functionality #6924
• Filter module never cleans up filter section in config leading to PHP warnings #6920
• Reset field types when new modules are installed to ensure potential new field types are immediately available #6919
• Minimum PHP version isn't consistently updated to 7.1 #6914
• Pre-existing field with reserved entity machine name re-used on entity type causes fatal error when adding entity #6900
• Undefined array key when getting the missing callback error in layouts #6885
• Add missing Excel Template (xlsb) MIME types so files show correct icons. #6882
• Unnecessary duplication in _entityreference_autocomplete_validate() #6879
• Form for "Manage file display" attempts to load all field formatter forms (elements) #6578
• node_access filters out accessible nodes when node is left joined #6421
• Date module datestamp field type affected by Y2K38 #6307
• Alias malfunction when two pages have the same title in multi-language installation #5947
• PDOException: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'backdrop.simpletest[xxxxx]semaphore' doesn't exist #5943
• Language prefixes are being repeated in Link module fields #4984
• Update the part in the documentation comment about array_filter #6303
• Correct a comment in backdrop_settings_initialize() #6663
• Remove direct use of new Node() and other direct instantiations of entity classes from the codebase #6075