Drupal core updates for December 3, 2014

What's new with Drupal 8?

• @alexpott premiered Config installer an install profile that takes over the Drupal installer and allows sites to be created from existing configuration. This opens the door for some interesting possibilities moving forward.
• We upgraded Drupal core to use Symfony 2.6 stable. Symfony 2.6 includes over 100 new features and enhancements. For full details see the release announcement.
• Following on from SA-CORE-2006 we removed mixed SSL support from core, focusing on security by default.
• We updated CKEditor library to 4.4.6, which included an important security fix. This also brought two new features, see the release announcement for more detail.
• We fixed a number of performance issues including Entity render cache is needlessly cleared when an Entity*Form*Display is modified, Convert all remaining attached individual CSS/JS assets to attached asset libraries and Themes should use libraries, not individual stylesheets and EntityRouteEnhancer and ContentFormControllerSubscriber implicitly depend on too many services.
• We are working to explain the configuration structures properly with configuration schemas. Recent big changes include all test views being validated and fixing user, system, link, etc. modules. There is still a long way to go, follow and join the efforts.
• We resolved a number of security issues including resolving the last missing default access for entity fields, the last one being taxonomy terms. We also made sure that twig debug output can't be used as an XSS vector.

Where's Drupal 8 at in terms of release?

Since the last Drupal Core Updates, we fixed 18 critical issues and 12 major issues, and opened 9 criticals and 18 majors. That puts us overall at 110 release-blocking critical issues and 705 major issues.

Part of managing Drupal 8 toward its release is continuously reassessing what must block a release of 8.0.0. (Remember, hundreds of thousands of people will benefit from all the great new functionality in Drupal 8, so we need to be smart about what does or doesn't hold up that release!) The chart below illustrates not only those newly discovered and newly fixed critical issues each week, but also issues that are promoted to critical and demoted from critical based on our latest understanding. For more information on what is (and isn't) release-blocking, see the handbook page on issue priority.

Current focus

The current top priority in Drupal 8 is to resolve issues that block a beta-to-beta upgrade path (critical issues tagged 'D8 upgrade path'). We also need core contributors to continue evaluating issues for the beta phase based on the beta changes policy.

Finally, keep an eye out for critical issues that are blocking other work.

How to get involved

If you're new to contributing to core, check out Core contribution mentoring hours. Twice per week, you can log into IRC and helpful Drupal core mentors will get you set up with answers to any of your questions, plus provide some useful issues to work on.

If you are interested in really digging into a tough problem and helping resolve a stagnating release blocker, or if you are stuck on a critical currently, join the #drupal-contribute IRC channel during weekly critical issue office hours on Fridays at 12:00p PST. See chx's office hours reports for an idea of what we've done so far!

If you'd like to contribute to a particular Drupal 8 initiative or working group, see the regularly scheduled meetings on the Drupal 8 core calendar. Google calendar ID: happypunch.com_eq0e09s0kvcs7v5scdi8f8cm70@group.calendar.google.com

You can also help by sponsoring independent Drupal core development.

Notable Commits

The best of git log --since "1 week ago" --pretty=oneline (70 commits in total):

• Issue 2359369 by mpdonadio, Berdir, bdurbin: Render cache is not cleared when module is uninstalled - cache invalidation is always hard :)
• Issue 2377281 by hussainweb, dawehner: Upgrade to Symfony 2.6 stable - getting close to the 2.7 LTS release
• Issue 2342593 by znerol, grendzy, David_Rothstein: Remove mixed SSL support from core - aligning Drupal with the wider web trends regarding https
• Issue 2369781 by larowlan: Ensure twig_debug output has needed sanitization - another critical security fix down
• Issue 2384581 by cilefen, Wim Leers: Security: Update CKEditor library to 4.4.6 - brings some security improvements
• Issue 2384163 by yched: Entity render cache is needlessly cleared when an Entity*Fom*Display is modified - performance++
• Issue 2368275 by martin107, dawehner, znerol, Crell, Wim Leers: EntityRouteEnhancer and ContentFormControllerSubscriber implicitly depend on too many services - ensuring our critical execution path is a lean as posisble
• Issue 2348459 by larowlan, alexarpen: Fields of type 'Text (formatted)' do NOT save values - a critical that was causing data loss when editor module was enabled
• Issue 2235901 by alexpott, mdrummond, iMiksu, sun, Wim Leers: Remove custom theme settings from *.info.yml - theme system using config objects like everything else
• Issue 2212335 by jhodgdon: Separate out NodeSearch::execute() into finding vs. processing results
• Issue 2377397 by Wim Leers, alexpott: Themes should use libraries, not individual stylesheets - moving us towards simplifying ajax page state, and smaller Javascript settings object - and hence increased performance

You can also always check the Change records for Drupal core for the full list of Drupal 8 API changes from Drupal 7.

Drupal 8 Around the Interwebs

Drupal 8 in "Real Life"

Whew! That's a wrap!

Do you follow Drupal Planet with devotion, or keep a close eye on the Drupal event calendar, or git pull origin 8.0.x every morning without fail before your coffee? We're looking for more contributors to help compile these posts. You could either take a few hours once every six weeks or so to put together a whole post, or help with one section more regularly. Read more about how you can volunteer to help with these posts!