4.5.1

Changes since 4.5.0.1

Core Update:

• Update Drupal core from 11.3.14 to 11.3.16
  • Guzzle: URI fragments disclosed in redirect Referer headers - CVE-2026-67354
  • Guzzle: Host-only cookie scope is not preserved - CVE-2026-67355
  • Guzzle: Unbounded response cookies risk denial of service - CVE-2026-67353
  • Guzzle: Proxy-Authorization headers can be sent to origin servers - CVE-2026-67339

Modules updated:

• Entity Browser module from 2.15.0 to 2.16.0
  • Entity Browser - Cross site scripting-Moderately critical-SA-CONTRIB-2026-094
• External Auth module from 2.0.12 to 2.0.13
  • External Authentication - Access bypass -Moderately critical - SA-CONTRIB-2026-098-
• Diff module from 1.10.0 to 2.0.1
  • Diff - Access bypass -Moderately critical -SA-CONTRIB-2026-096

Full Changelog: 4.5.0.1...4.5.1