composer.json

@@ -16,17 +16,19 @@
     },
     "require-dev": {
         "behat/mink": "^1.8",
-        "friends-of-behat/mink-browserkit-driver": "^1.3",
+        "friends-of-behat/mink-browserkit-driver": "^1.4",
         "behat/mink-goutte-driver": "^1.2",
         "behat/mink-selenium2-driver": "^1.4",
         "composer/composer": "^2.0.2",
-        "drupal/coder": "^8.3.7",
+        "drupal/coder": "^8.3.10",
+        "fabpot/goutte": "^3.3",
+        "instaclick/php-webdriver": "^1.4.1",
         "mikey179/vfsstream": "^1.6.8",
-        "phpunit/phpunit": "^8.4.1 || ^9",
-        "phpspec/prophecy": "^1.7",
+        "phpunit/phpunit": "^8.5.14 || ^9",
+        "phpspec/prophecy": "^1.12",
         "symfony/css-selector": "^4.4",
-        "symfony/phpunit-bridge": "^5.1.4",
-        "symfony/var-dumper": "^5.1.2",
+        "symfony/phpunit-bridge": "^5.3.0",
+        "symfony/var-dumper": "^5.3.0",
         "symfony/error-handler": "^4.4",
         "justinrainbow/json-schema": "^5.2",
         "symfony/filesystem": "^4.4",
@@ -49,6 +51,11 @@
         "autoloader-suffix": "Drupal9",
         "platform": {
             "php": "7.3.0"
+        },
+        "allow-plugins": {
+            "composer/installers": true,
+            "drupal/core-project-message": true,
+            "drupal/core-vendor-hardening": true
         }
     },
     "extra": {

composer/Metapackage/CoreRecommended/composer.json

@@ -9,59 +9,60 @@
     "require": {
         "drupal/core": "9.2.x-dev",
         "asm89/stack-cors": "1.3.0",
-        "composer/semver": "3.2.4",
-        "doctrine/annotations": "1.12.1",
+        "composer/semver": "3.2.5",
+        "doctrine/annotations": "1.13.1",
         "doctrine/lexer": "1.2.1",
         "doctrine/reflection": "1.2.2",
         "egulias/email-validator": "2.1.25",
-        "guzzlehttp/guzzle": "6.5.5",
+        "guzzlehttp/guzzle": "6.5.7",
         "guzzlehttp/promises": "1.4.1",
-        "guzzlehttp/psr7": "1.8.1",
-        "laminas/laminas-diactoros": "2.5.0",
+        "guzzlehttp/psr7": "1.8.5",
+        "laminas/laminas-diactoros": "2.6.0",
         "laminas/laminas-escaper": "2.7.0",
-        "laminas/laminas-feed": "2.14.0",
+        "laminas/laminas-feed": "2.14.1",
         "laminas/laminas-stdlib": "3.3.1",
         "laminas/laminas-zendframework-bridge": "1.2.0",
         "masterminds/html5": "2.7.4",
-        "pear/archive_tar": "1.4.13",
+        "pear/archive_tar": "1.4.14",
         "pear/console_getopt": "v1.4.3",
         "pear/pear-core-minimal": "v1.10.10",
         "pear/pear_exception": "v1.0.2",
+        "psr/cache": "1.0.1",
         "psr/container": "1.1.1",
         "psr/http-factory": "1.0.1",
         "psr/http-message": "1.0.1",
-        "psr/log": "1.1.3",
+        "psr/log": "1.1.4",
         "ralouphie/getallheaders": "3.0.3",
         "stack/builder": "v1.0.6",
         "symfony-cmf/routing": "2.3.3",
-        "symfony/console": "v4.4.21",
-        "symfony/debug": "v4.4.20",
-        "symfony/dependency-injection": "v4.4.21",
-        "symfony/deprecation-contracts": "v2.2.0",
-        "symfony/error-handler": "v4.4.21",
-        "symfony/event-dispatcher": "v4.4.20",
+        "symfony/console": "v4.4.25",
+        "symfony/debug": "v4.4.25",
+        "symfony/dependency-injection": "v4.4.25",
+        "symfony/deprecation-contracts": "v2.4.0",
+        "symfony/error-handler": "v4.4.25",
+        "symfony/event-dispatcher": "v4.4.25",
         "symfony/event-dispatcher-contracts": "v1.1.9",
-        "symfony/http-client-contracts": "v2.3.1",
-        "symfony/http-foundation": "v4.4.20",
-        "symfony/http-kernel": "v4.4.21",
-        "symfony/mime": "v5.2.6",
-        "symfony/polyfill-ctype": "v1.22.1",
-        "symfony/polyfill-iconv": "v1.22.1",
-        "symfony/polyfill-intl-idn": "v1.22.1",
-        "symfony/polyfill-intl-normalizer": "v1.22.1",
-        "symfony/polyfill-mbstring": "v1.22.1",
-        "symfony/polyfill-php80": "v1.22.1",
-        "symfony/process": "v4.4.20",
+        "symfony/http-client-contracts": "v2.4.0",
+        "symfony/http-foundation": "v4.4.25",
+        "symfony/http-kernel": "v4.4.25",
+        "symfony/mime": "v5.3.0",
+        "symfony/polyfill-ctype": "v1.23.0",
+        "symfony/polyfill-iconv": "v1.23.0",
+        "symfony/polyfill-intl-idn": "v1.23.0",
+        "symfony/polyfill-intl-normalizer": "v1.23.0",
+        "symfony/polyfill-mbstring": "v1.23.0",
+        "symfony/polyfill-php80": "v1.23.0",
+        "symfony/process": "v4.4.25",
         "symfony/psr-http-message-bridge": "v2.1.0",
-        "symfony/routing": "v4.4.20",
-        "symfony/serializer": "v4.4.20",
-        "symfony/service-contracts": "v2.2.0",
-        "symfony/translation": "v4.4.21",
-        "symfony/translation-contracts": "v2.3.0",
-        "symfony/validator": "v4.4.21",
-        "symfony/var-dumper": "v5.2.6",
-        "symfony/yaml": "v4.4.21",
-        "twig/twig": "v2.14.4",
+        "symfony/routing": "v4.4.25",
+        "symfony/serializer": "v4.4.35",
+        "symfony/service-contracts": "v2.4.0",
+        "symfony/translation": "v4.4.25",
+        "symfony/translation-contracts": "v2.4.0",
+        "symfony/validator": "v4.4.25",
+        "symfony/var-dumper": "v5.3.0",
+        "symfony/yaml": "v4.4.25",
+        "twig/twig": "v2.14.11",
         "typo3/phar-stream-wrapper": "v3.1.6"
     }
 }

composer/Metapackage/DevDependencies/composer.json

@@ -11,13 +11,15 @@
         "behat/mink-goutte-driver": "^1.2",
         "behat/mink-selenium2-driver": "^1.4",
         "composer/composer": "^2.0.2",
-        "drupal/coder": "^8.3.7",
+        "drupal/coder": "^8.3.10",
         "easyrdf/easyrdf": "^0.9 || ^1.0",
-        "friends-of-behat/mink-browserkit-driver": "^1.3",
+        "fabpot/goutte": "^3.3",
+        "friends-of-behat/mink-browserkit-driver": "^1.4",
+        "instaclick/php-webdriver": "^1.4.1",
         "justinrainbow/json-schema": "^5.2",
         "mikey179/vfsstream": "^1.6.8",
-        "phpspec/prophecy": "^1.7",
-        "phpunit/phpunit": "^8.4.1 || ^9",
+        "phpspec/prophecy": "^1.12",
+        "phpunit/phpunit": "^8.5.14 || ^9",
         "symfony/browser-kit": "^4.4",
         "symfony/css-selector": "^4.4",
         "symfony/dom-crawler": "^4.4 !=4.4.5",
@@ -25,7 +27,7 @@
         "symfony/filesystem": "^4.4",
         "symfony/finder": "^4.4",
         "symfony/lock": "^4.4",
-        "symfony/phpunit-bridge": "^5.1.4",
-        "symfony/var-dumper": "^5.1.2"
+        "symfony/phpunit-bridge": "^5.3.0",
+        "symfony/var-dumper": "^5.3.0"
     }
 }

composer/Metapackage/PinnedDevDependencies/composer.json

@@ -12,16 +12,18 @@
         "behat/mink-goutte-driver": "v1.2.1",
         "behat/mink-selenium2-driver": "v1.4.0",
         "composer/ca-bundle": "1.2.9",
-        "composer/composer": "2.0.11",
+        "composer/composer": "2.2.12",
+        "composer/metadata-minifier": "1.0.0",
+        "composer/pcre": "1.0.1",
         "composer/spdx-licenses": "1.5.5",
-        "composer/xdebug-handler": "1.4.6",
+        "composer/xdebug-handler": "2.0.1",
         "doctrine/instantiator": "1.4.0",
-        "drupal/coder": "8.3.12",
+        "drupal/coder": "8.3.13",
         "easyrdf/easyrdf": "1.1.1",
         "fabpot/goutte": "v3.3.1",
         "friends-of-behat/mink-browserkit-driver": "v1.5.0",
         "instaclick/php-webdriver": "1.4.7",
-        "justinrainbow/json-schema": "5.2.10",
+        "justinrainbow/json-schema": "5.2.11",
         "mikey179/vfsstream": "v1.6.8",
         "myclabs/deep-copy": "1.10.2",
         "phar-io/manifest": "2.0.1",
@@ -52,14 +54,14 @@
         "seld/jsonlint": "1.8.3",
         "seld/phar-utils": "1.1.1",
         "sirbrillig/phpcs-variable-analysis": "v2.11.0",
-        "squizlabs/php_codesniffer": "3.5.8",
-        "symfony/browser-kit": "v4.4.20",
-        "symfony/css-selector": "v4.4.20",
-        "symfony/dom-crawler": "v4.4.20",
-        "symfony/filesystem": "v4.4.21",
-        "symfony/finder": "v4.4.20",
-        "symfony/lock": "v4.4.21",
-        "symfony/phpunit-bridge": "v5.2.6",
+        "squizlabs/php_codesniffer": "3.6.0",
+        "symfony/browser-kit": "v4.4.25",
+        "symfony/css-selector": "v4.4.25",
+        "symfony/dom-crawler": "v4.4.25",
+        "symfony/filesystem": "v4.4.25",
+        "symfony/finder": "v4.4.25",
+        "symfony/lock": "v4.4.25",
+        "symfony/phpunit-bridge": "v5.3.0",
         "theseer/tokenizer": "1.2.0",
         "webmozart/assert": "1.10.0"
     }

composer/Plugin/Scaffold/README.md

@@ -48,14 +48,14 @@ their destination location. In order to prevent arbitrary dependencies from
 copying files via the scaffold mechanism, only those projects that are
 specifically permitted by the top-level project will be used to scaffold files.
 
-Example: Permit scaffolding from the project `drupal/core`
+Example: Permit scaffolding from the project `upstream/project`
 ```
   "name": "my/project",
   ...
   "extra": {
     "drupal-scaffold": {
       "allowed-packages": [
-        "drupal/core"
+        "upstream/project"
       ],
       ...
     }
@@ -63,8 +63,9 @@ Example: Permit scaffolding from the project `drupal/core`
 ```
 Allowing a package to scaffold files also permits it to delegate permission to
 scaffold to any project that it requires itself. This allows a package to
-organize its scaffold assets as it sees fit. For example, the project
-`drupal/core` may choose to store its assets in a subproject `drupal/assets`.
+organize its scaffold assets as it sees fit. For example, if `upstream/project`
+stores its assets in a subproject `upstream/assets`, `upstream/assets` would
+implicitly be allowed to scaffold files.
 
 It is possible for a project to obtain scaffold files from multiple projects.
 For example, a Drupal project using a distribution, and installing on a specific
@@ -393,9 +394,6 @@ Sample composer.json for a project that relies on packages that use composer-sca
   },
   "extra": {
     "drupal-scaffold": {
-      "allowed-packages": [
-        "drupal/core"
-      ],
       "locations": {
         "web-root": "./docroot"
       },

composer/Plugin/Scaffold/ScaffoldFilePath.php

@@ -21,7 +21,7 @@
 class ScaffoldFilePath {
 
   /**
-   * The type of scaffold file this is, 'src' or 'dest'.
+   * The type of scaffold file this is,'autoload', 'dest' or 'src'.
    *
    * @var string
    */
@@ -52,7 +52,7 @@ class ScaffoldFilePath {
    * ScaffoldFilePath constructor.
    *
    * @param string $path_type
-   *   The type of scaffold file this is, 'src' or 'dest'.
+   *   The type of scaffold file this is,'autoload', 'dest' or 'src'.
    * @param string $package_name
    *   The name of the package containing the file.
    * @param string $rel_path

core/.eslintrc.json

@@ -19,6 +19,7 @@
     "Backbone": true,
     "Modernizr": true,
     "Popper": true,
+    "Shepherd": true,
     "Sortable": true,
     "once": true,
     "CKEDITOR": true,

core/.stylelintrc.json

 {
   "extends": "stylelint-config-standard",
   "plugins": [
-    "stylelint-no-browser-hacks/lib",
     "stylelint-order"
   ],
   "rules": {
@@ -445,16 +444,6 @@
       "font-smooth",
       "line-height"
     ],
-    "plugin/no-browser-hacks": [true, {
-      "browsers": [
-        "ie >= 9",
-        "edge >= 13",
-        "firefox >= 5",
-        "opera >= 12",
-        "safari >= 5",
-        "chrome >= 56"
-      ]
-    }],
     "property-no-unknown": null,
     "rule-empty-line-before": null,
     "selector-pseudo-element-colon-notation": null,

core/MAINTAINERS.txt

@@ -32,10 +32,13 @@ Framework managers
 
   Frontend
   - Lauri Eskola 'lauriii' https://www.drupal.org/u/lauriii
+  - (provisional) Cristina Chumillas 'ckrina' https://www.drupal.org/u/ckrina
+  - (provisional) Ben Mullins 'bnjmnm' https://www.drupal.org/u/bnjmnm
 
 Release managers
 - Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
 - Jess Myrbo 'xjm' https://www.drupal.org/u/xjm
+- (provisional) Victoria Spagnolo 'quietone' https://www.drupal.org/u/quietone
 
 Core JavaScript packages
  - (provisional) Théodore Biadala 'nod_' https://www.drupal.org/u/nod_
@@ -260,8 +263,9 @@ JavaScript
 - Sally Young 'justafish' https://www.drupal.org/u/justafish
 
 JSON:API
-- Gabe Sullice 'gabesullice' https://www.drupal.org/u/gabesullice
 - Mateu Aguiló Bosch 'e0ipso' https://www.drupal.org/u/e0ipso
+- Björn Brala 'bbrala' https://www.drupal.org/u/bbrala
+- Gabe Sullice 'gabesullice' https://www.drupal.org/u/gabesullice
 - Wim Leers 'Wim Leers' https://www.drupal.org/u/wim-leers
 
 Language
@@ -310,7 +314,7 @@ Migrate
 - Adam Globus-Hoenich 'phenaproxima' https://www.drupal.org/u/phenaproxima
 - Lucas Hedding 'heddn' https://www.drupal.org/u/heddn
 - Michael Lutz 'mikelutz' https://www.drupal.org/u/mikelutz
-- Vicki Spagnolo 'quietone' https://www.drupal.org/u/quietone
+- Victoria Spagnolo 'quietone' https://www.drupal.org/u/quietone
 
 Node
 - ?
@@ -449,8 +453,9 @@ Umami demo
 - Keith Jay 'kjay' https://www.drupal.org/u/kjay
 - Ofer Shaal 'shaal' https://www.drupal.org/u/shaal
 
-Update UI
-- ?
+Update Manager
+- Ted Bowman 'tedbow' https://www.drupal.org/u/tedbow
+- Derek Wright 'dww' https://www.drupal.org/u/dww
 
 User
 - Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
@@ -519,7 +524,7 @@ their responsibilities. The initiative coordinators are:
 
 Decoupled Menus Initiative
 - Théodore Biadala 'nod_' https://www.drupal.org/u/nod_
-- Gabe Sullice 'gabesullice' https://www.drupal.org/u/gabesullice
+- Brian Perry 'brianperry' https://www.drupal.org/u/brianperry
 
 Media Initiative
 - Janez Urevc 'slashrsm' https://www.drupal.org/u/slashrsm

core/assets/scaffold/files/default.services.yml

@@ -169,10 +169,10 @@ parameters:
     - webcal
     - rtsp
 
-   # Configure Cross-Site HTTP requests (CORS).
-   # Read https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
-   # for more information about the topic in general.
-   # Note: By default the configuration is disabled.
+  # Configure Cross-Site HTTP requests (CORS).
+  # Read https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
+  # for more information about the topic in general.
+  # Note: By default the configuration is disabled.
   cors.config:
     enabled: false
     # Specify allowed headers, like 'x-allowed-header'.

core/assets/scaffold/files/default.settings.php

 <?php
 
-// @codingStandardsIgnoreFile
+// phpcs:ignoreFile
 
 /**
  * @file
@@ -308,16 +308,18 @@
 $settings['update_free_access'] = FALSE;
 
 /**
- * Fallback to HTTP for Update Manager.
+ * Fallback to HTTP for Update Manager and for fetching security advisories.
  *
- * If your Drupal site fails to connect to updates.drupal.org using HTTPS to
- * fetch Drupal core, module and theme update status, you may uncomment this
- * setting and set it to TRUE to allow an insecure fallback to HTTP. Note that
- * doing so will open your site up to a potential man-in-the-middle attack. You
- * should instead attempt to resolve the issues before enabling this option.
+ * If your site fails to connect to updates.drupal.org over HTTPS (either when
+ * fetching data on available updates, or when fetching the feed of critical
+ * security announcements), you may uncomment this setting and set it to TRUE to
+ * allow an insecure fallback to HTTP. Note that doing so will open your site up
+ * to a potential man-in-the-middle attack. You should instead attempt to
+ * resolve the issues before enabling this option.
  * @see https://www.drupal.org/docs/system-requirements/php-requirements#openssl
  * @see https://en.wikipedia.org/wiki/Man-in-the-middle_attack
  * @see \Drupal\update\UpdateFetcher
+ * @see \Drupal\system\SecurityAdvisories\SecurityAdvisoriesFetcher
  */
 # $settings['update_fetch_with_http_fallback'] = TRUE;
 
@@ -609,6 +611,21 @@
 # ini_set('pcre.backtrack_limit', 200000);
 # ini_set('pcre.recursion_limit', 200000);
 
+/**
+ * Add Permissions-Policy header to disable Google FLoC.
+ *
+ * By default, Drupal sends the 'Permissions-Policy: interest-cohort=()' header
+ * to disable Google's Federated Learning of Cohorts feature, introduced in
+ * Chrome 89.
+ *
+ * See https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts for more
+ * information about FLoC.
+ *
+ * If you don't wish to disable FLoC in Chrome, you can set this value
+ * to FALSE.
+ */
+# $settings['block_interest_cohort'] = TRUE;
+
 /**
  * Configuration overrides.
  *

core/assets/scaffold/files/example.settings.local.php

 <?php
 
-// @codingStandardsIgnoreFile
+// phpcs:ignoreFile
 
 /**
  * @file

core/assets/scaffold/files/example.sites.php

 <?php
 
-// @codingStandardsIgnoreFile
+// phpcs:ignoreFile
 
 /**
  * @file

core/assets/vendor/ckeditor/LICENSE.md

@@ -2,7 +2,7 @@ Software License Agreement
 ==========================
 
 CKEditor - The text editor for Internet - https://ckeditor.com/
-Copyright (c) 2003-2020, CKSource - Frederico Knabben. All rights reserved.
+Copyright (c) 2003-2022, CKSource Holding sp. z o.o. All rights reserved.
 
 Licensed under the terms of any of the following licenses at your
 choice:
@@ -37,10 +37,11 @@ done by developers outside of CKSource with their express permission.
 
 The following libraries are included in CKEditor under the MIT license (see Appendix D):
 
-* CKSource Samples Framework (included in the samples) - Copyright (c) 2014-2020, CKSource - Frederico Knabben.
+* CKSource Samples Framework (included in the samples) - Copyright (c) 2014-2022, CKSource Holding sp. z o.o.
 * PicoModal (included in `samples/js/sf.js`) - Copyright (c) 2012 James Frasca.
 * CodeMirror (included in the samples) - Copyright (C) 2014 by Marijn Haverbeke <marijnh@gmail.com> and others.
 * ES6Promise - Copyright (c) 2014 Yehuda Katz, Tom Dale, Stefan Penner and contributors.
+* A polyfill for `CSS.escape` (adopted with modifications in `core/tools.js`), Mathias Bynens, v1.5.1, https://mths.be/cssescape.
 
 Parts of code taken from the following libraries are included in CKEditor under the MIT license (see Appendix D):
 
@@ -59,7 +60,7 @@ The following libraries are included in CKEditor under the BSD-3 License (see Ap
 Trademarks
 ----------
 
-CKEditor is a trademark of CKSource - Frederico Knabben. All other brand
+CKEditor is a trademark of CKSource Holding sp. z o.o. All other brand
 and product names are trademarks, registered trademarks or service
 marks of their respective holders.
 
@@ -1419,3 +1420,17 @@ Redistribution and use in source and binary forms, with or without modification,
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ```
 
+
+Appendix H: The BSD-2 License
+-----------------------------
+
+```
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```
+
+(Ignore this line: %REMOVE_START%)

core/assets/vendor/ckeditor/SECURITY.md

+# Reporting a security issues
+
+If you believe you have found a security issue in the CKEditor 4 software, please contact us immediately.
+
+When reporting a potential security problem, please bear this in mind:
+
+*   Make sure to provide as many details as possible about the vulnerability.
+*   Please do not disclose publicly any security issues until we fix them and publish security releases.
+
+Contact the security team at security@cksource.com. As soon as we receive the security report, we will work promptly to confirm the issue and then to provide a security fix.

core/assets/vendor/ckeditor/build-config.js

@@ -32,6 +32,7 @@ var CKBUILDER_CONFIG = {
 		'.bender',
 		'bender-err.log',
 		'bender-out.log',
+		'bender-runner.config.json',
 		'.travis.yml',
 		'dev',
 		'docs',

core/assets/vendor/ckeditor/lang/_translationstatus.txt

-Copyright (c) 2003-2020, CKSource - Frederico Knabben. All rights reserved.
+Copyright (c) 2003-2022, CKSource Holding sp. z o.o. All rights reserved.
 For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license
 
 af.js      Found: 62 Missing: 4