Views Bulk Operations 4.4.8 Fixes Large-View Count Query and Custom Action Regression

Version 4.4.8 of Views Bulk Operations (VBO) fixes defects affecting confirmation performance and custom action compatibility. According to the release notes published 8 September 2026, the stable update supports Drupal 10.3 and Drupal 11. It also includes four fixes covering selection behaviour and AJAX or runtime errors.

The count-query correction is most relevant on large administrative Views. The issue history shows that the confirmation form could generate a count query across potentially thousands of items instead of restricting the query to the smaller set selected for the bulk operation. Version 4.4.8 applies the selection condition to that count query, reducing unnecessary database work during confirmation.

The release also removes an array return-type declaration from ViewsBulkOperationsActionBase::executeMultiple(). The associated issue says the declaration was introduced in version 4.4.6 and could cause a PHP fatal error when a child action class overrode the method without the matching return type. Version 4.4.8 removes immediate enforcement and introduces a deprecation path before the stricter type is added in a future major release.

Other changes correct Select/Deselect All when a VBO field uses a non-default Views field identifier, remove a fullscreen AJAX loader that could remain after a successful selection update, and guard against a crash when selecting table rows. The release also gives the module's $view property a null default to prevent an uninitialised typed-property error. The select-all defect could leave visible row checkboxes unchecked even while VBO recorded and reported all results as selected.

Drupal.org reports that 148,209 sites use Views Bulk Operations. That project-wide figure does not indicate how many sites ran affected versions or encountered these defects. Although stable VBO releases are covered by Drupal's security advisory policy, Drupal.org classifies version 4.4.8 as a bug-fix release and its release notes do not identify a security vulnerability.