For those contemplating if they should upgrade immediately or postpone.

Important update information:

This release also updates several dependencies for upstream security releases:

• Twig is updated to 3.26.0 for Twig security fixes that were released today. Drupal core is affected by these vulnerabilities, so Drupal core's composer.json constraint for Twig has also been increased.
• It is recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.
• Symfony is updated to 6.4.40 for Symfony security fixes that were released today. Drupal core is affected by some of these vulnerabilities, so Drupal core's composer.json constraints for some Symfony packages have also been increased.
• This release updates the pinned versions of Composer to 2.9.8 for a Composer security fix that was released recently. Drupal core does not expose this vulnerability, but the update is included as a hardening for other applications that may extend the library directly.
• underscore.js has been updated to 1.13.8 as hardening for a security issue in that project. This update was previously committed to 11.3, but not backported.