Updated Drupal core and contrib dependencies.

[AlexSkrypnyk]

Checklist before requesting a review

• Subject includes ticket number as [#123] Verb in past tense.
• Ticket number #123 added to description
• Added context in Changed section
• Self-reviewed code and commented in commented complex areas.
• Added tests for fix/feature.
• Relevant tests run and passed locally.

Changed

Routine Drupal core and contrib dependency maintenance update. Drupal core stayed on 11.4.4 since no new core release was available; ten packages were updated in total, the most notable being a major-version bump of the Solr client library solarium/solarium (6.4.1 to 7.0.0), a transitive dependency pulled in by the drupal/search_api_solr update (4.3.10 to 4.3.13). No security vulnerability advisories were found - composer audit ran clean and composer validate --strict passed with a normalized composer.json.

What changed

• Drupal core remained on 11.4.4; this update refreshed its underlying HTTP and JavaScript-parsing libraries to their latest releases.
• Ten packages were updated in total - a mix of Drupal contributed modules, the Solr search stack, and developer tooling.
• One major-version dependency change landed: the Solr client library moved from 6.4.1 to 7.0.0, pulled in by the search module update.
• Risk is low to moderate: most changes are patch and minor releases, with the Solr client the only item warranting focused testing.
• No security vulnerability advisories found.

Key highlights

• Drupal core stayed at 11.4.4 with no configuration or schema changes.
• HTTP and API stack refreshed: guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to 2.13.0.
• Search stack advanced: drupal/search_api_solr to 4.3.13 and its Solr client solarium/solarium to 7.0.0 (major).
• Cache invalidation module drupal/purge moved to 3.7.0.
• Developer tooling updated: mglaman/phpstan-drupal to 2.1.1, slevomat/coding-standard to 8.31.0, and the JavaScript parser mck89/peast to 1.17.7.
• API integration library openai-php/client moved to 0.20.1.

Testing focus

• Run a site search and confirm results return correctly, including filtered and faceted queries.
• Re-index search content and verify indexing completes without errors.
• Confirm cache clearing and content invalidation behave normally after editing or publishing content.
• Exercise bulk content operations from admin listings (select rows, apply an action).
• Verify AI-assisted content features complete and return responses.
• Smoke-test key pages for correct rendering with no broken assets.

Overall impact

This is a routine maintenance update that keeps the platform's underlying libraries current. The content management system itself remains on the same version, so editors and site visitors should see no change in day-to-day behaviour.

The majority of the updated components are small, low-risk releases. The one item that warrants attention is the search subsystem, whose underlying client library advanced by a major version. Search is expected to continue working normally, but it is the primary area to confirm during testing.

No security issues were reported for any of the updated components. Overall risk is low and no regressions are anticipated. Standard verification of search, caching, and content operations is sufficient before release.

Changes

• drupal/purge updated from 3.6.0 to 3.7.0 (minor)
• drupal/search_api_solr updated from 4.3.10 to 4.3.13 (patch)
• drupal/views_bulk_operations updated from 4.4.6 to 4.4.7 (patch)
• guzzlehttp/guzzle updated from 7.14.2 to 7.15.1 (minor) - see changes / release notes
• guzzlehttp/psr7 updated from 2.12.5 to 2.13.0 (minor) - see changes / release notes
• mck89/peast updated from 1.17.6 to 1.17.7 (patch) - see changes / release notes
• mglaman/phpstan-drupal updated from 2.1.0 to 2.1.1 (patch) - see changes / release notes
• openai-php/client updated from 0.20.0 to 0.20.1 (patch) - see changes / release notes
• slevomat/coding-standard updated from 8.30.1 to 8.31.0 (minor) - see changes / release notes
• solarium/solarium updated from 6.4.1 to 7.0.0 (major) - see changes / release notes

Screenshots

N/A

Before / After

Drupal core
  11.4.4 ------------------------------------------------> 11.4.4   (unchanged, no release available)

Contrib modules
  drupal/purge                  3.6.0   --minor-->  3.7.0
  drupal/search_api_solr        4.3.10  --patch-->  4.3.13
  drupal/views_bulk_operations  4.4.6   --patch-->  4.4.7

Solr client (transitive, pulled in by search_api_solr)
  solarium/solarium              6.4.1  ==MAJOR==>  7.0.0   <-- primary testing focus

HTTP / JS stack (transitive, pulled in by core)
  guzzlehttp/guzzle             7.14.2  --minor-->  7.15.1
  guzzlehttp/psr7               2.12.5  --minor-->  2.13.0
  mck89/peast                   1.17.6  --patch-->  1.17.7

Dev tooling
  mglaman/phpstan-drupal         2.1.0  --patch-->  2.1.1
  slevomat/coding-standard       8.30.1 --minor-->  8.31.0
  openai-php/client              0.20.0 --patch-->  0.20.1

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 481e015d-9e59-4913-81d5-2dd4fcfbc335

📥 Commits

Reviewing files that changed from the base of the PR and between efa259f and c0808b4.

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• composer.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/drupal-updates-2026-07-22

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code coverage (threshold: 80%)

  Classes: 50.00% (7/14)
  Methods: 73.33% (22/30)
  Lines:   93.18% (355/381)

Per-class coverage

Drupal\do_content_api\EventSubscriber\JsonApiWriteGateSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  88.89% (  8/  9)
Drupal\do_content_api\Hook\EntityCreateAccessHook
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  9/  9)
Drupal\do_content_api\Hook\ModerationPolicyHook
  Methods:  50.00% ( 1/ 2)   Lines:  93.75% ( 15/ 16)
Drupal\do_content_api\Routing\RouteSubscriber
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  6/  6)
Drupal\do_feed\FeedUrlBuilder
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 18/ 18)
Drupal\do_feed\Form\FeedSettingsForm
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 15/ 15)
Drupal\do_feed\Hook\EntityDeleteHook
  Methods:  50.00% ( 1/ 2)   Lines:  92.31% ( 12/ 13)
Drupal\do_feed\Hook\EntityPresaveHook
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 54/ 54)
Drupal\do_feed\Hook\PreprocessParagraphHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 14/ 14)
Drupal\do_feed\Hook\PreprocessViewsViewRowRssHook
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  3/  3)
Drupal\do_feed\Hook\ViewsPreViewHook
  Methods:  50.00% ( 1/ 2)   Lines:  96.43% ( 27/ 28)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.16%. Comparing base (efa259f) to head (c0808b4).
⚠️ Report is 3 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #253   +/-   ##
========================================
  Coverage    89.16%   89.16%           
========================================
  Files           15       15           
  Lines          203      203           
========================================
  Hits           181      181           
  Misses          22       22           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.