Backdrop 1.32.3 Release checklist

[quicksketch]

Release scheduled for April 22, 2026 10am - 4pm PT

Pre-release tasks

• Merge commits (@quicksketch)
• Create the next bugfix milestone (@quicksketch)
• Move all unfinished issues to the next bugfix release milestone (@quicksketch)
• Review all closed issues in milestone: (@jenlampton)
  • Issue titles should include a complete, but very brief summary of the problem.
  • Bug issue titles should start with Fix or Fixed,
  • New feature issue titles should start with Add or Added.
  • Each issue should have accurate labels, especially the "type - " labels.
• Close the milestone (@quicksketch)
• Draft Release notes (@quicksketch)
  • Include a short, descriptive summary of the release, for example:
    • "Security release for Backdrop CMS. This release fixes 1 security vulnerability:"
    • Include a list of SA's for commits to this release
  • Include a section heading ## Notes for updating*
    • Note if any changes were made to files outside the core directory, for example:
      • - No changes have been made to the `.htaccess`, `robots.txt` or default `settings.php` files in this release. Updating customized versions of those files is not necessary.
      • See this example for updates to .htaccess
      • See this example or this example for updates to settings.php
    • Note if updates (update.php) needs to be run, for example:
      • Use the text The database update script does **not** need to be run.
      • or **It will be necessary to run the update script** (located at /core/update.php) for this release.
      • Note: you can use this command to see if any install files were changed:
        ls -1 core/modules/*/*.install | while read filename; do echo "$(git log -1 --pretty="format:%ad %f" --date=format:"%F %R" -- $filename)" $filename; done|sort
  • Include a section heading ## Changes since version 1.xx.x
    • Navigate to Actions
    • Select the most recent time "Release Notes Generator" has been run.
    • Download the release-notes artifact attached to the generator.
    • Unzip the file, and copy/pate contents into release notes draft.
      • Move the headings to H3, add another # before the ## to get ###.
    • Remove any square brackets in the titles, and move those issues to their own section.
• Draft Security Advisories (@jenlampton @herbdool @laryn)

Release tasks

• Update bootstrap.inc with version number (@quicksketch)
• Tag for release, and push tag to GitHub (@quicksketch)
• Revert version number back (@quicksketch)
• Create release notes on GitHub, and publish release (@jenlampton @herbdool @laryn)
• Publish Security Advisories on b.org (@jenlampton @herbdool @laryn)
• Mark the release node on b.org as a security release (@jenlampton @herbdool @laryn)

See Also

• Checklist for 1.33.2 release

[quicksketch]

The https://github.com/backdrop/backdrop/releases/tag/1.32.3 tag is cut.

Note that this release should go out first, followed by 1.33.2.

This release contains only security fixes.

[quicksketch]

Release notes draft:

---

Security release for Backdrop CMS. This release fixes 3 security vulnerabilities:

• BACKDROP-SA-CORE-2026-001
• BACKDROP-SA-CORE-2026-002
• BACKDROP-SA-CORE-2026-003

And includes one security hardening:

• BACKDROP-SA-CORE-2026-004

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

This release contains the security fixes only and no other changes.

---

Note that all the security announcements have yet to be created/published.

[quicksketch]

Release is now out and marked as security release. Thank you @laryn for drafting all the security announcements!