Drupal 11.4.3 Fixes Route Discovery Regression

Drupal core maintainers released Drupal 11.4.3 on 14 July 2026 at 09:34 UTC as a production-ready bugfix release for Drupal 11, according to Drupal.org release notes.

The release gives Drupal teams another maintenance point in the 11.4 branch. Drupal 11.4.2 had addressed update-path regressions involving Composer scaffolding and fatal errors on sites using Search or Help, while also listing a route-discovery regression as a known issue.

Drupal 11.4.3 fixes that route-discovery issue, tracked as #3608776. The issue summary says StaticRouteDiscoveryBase::createRoute() did not fully match Symfony route creation because it accepted arrays for methods and schemes but not single string values. The fix widens two protected method parameter types to match Symfony and earlier Drupal behaviour.

The release also fixes a separate routing problem in AttributeRouteDiscovery. Drupal.org says invokable controllers using a class-only #[Route] attribute were not registering routes because of an incorrect condition.

Other changes in Drupal 11.4.3 cover stream-wrapper service instantiation errors, invalid use of the array union operator, repeated ComponentNegotiator::negotiate() calls when no replacement is found, aggregate entity query cloning behaviour, and rollback handling in WorkspacePublisher when a PHP error occurs during publishing.

The release also fixes the locale.check_translation route, which Drupal.org says was not protected against cross-site request forgery. Drupal.org lists the item among the bug fixes included since Drupal 11.4.2.

Drupal 11.4.3 follows a short sequence of 11.4 patch releases. Drupal 11.4.0 was released on 1 July 2026, Drupal 11.4.1 followed on 3 July 2026, Drupal 11.4.2 on 10 July 2026, and Drupal 11.4.3 on 14 July 2026.

Drupal 11.4.x will receive security coverage until June 2027.