diff --git a/composer.json b/composer.json
index 77712c96588300bc1c08d2affd676f328b5960a8..a2f9db3c3373773af6ed60c2d791c52ba3b78ec5 100644
--- a/composer.json
+++ b/composer.json
@@ -113,7 +113,7 @@
         "drupal/entity": "1.2",
         "drupal/entity_browser": "2.6",
         "drupal/entity_clone": "1.0.0-beta5",
-        "drupal/entity_embed": "1.1",
+        "drupal/entity_embed": "1.2",
         "drupal/entity_reference_revisions": "1.9",
         "drupal/externalauth": "1.3",
         "drupal/field_group": "3.1",
diff --git a/composer.lock b/composer.lock
index 8ba77449a0f8c707c040cd893cbd4e576753398f..9c4fd02d076bca84f051973b4b3406689230c74d 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "d92afd65f29182ece4d6df27d3215b4d",
+    "content-hash": "04472c07c5b5a01b41fef18c41986b67",
     "packages": [
         {
             "name": "alchemy/zippy",
@@ -4032,17 +4032,17 @@
         },
         {
             "name": "drupal/entity_embed",
-            "version": "1.1.0",
+            "version": "1.2.0",
             "source": {
                 "type": "git",
                 "url": "https://git.drupalcode.org/project/entity_embed.git",
-                "reference": "8.x-1.1"
+                "reference": "8.x-1.2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://ftp.drupal.org/files/projects/entity_embed-8.x-1.1.zip",
-                "reference": "8.x-1.1",
-                "shasum": "f2c3f4b3071cbd69db94c5255e1db89510995b5d"
+                "url": "https://ftp.drupal.org/files/projects/entity_embed-8.x-1.2.zip",
+                "reference": "8.x-1.2",
+                "shasum": "e1d4c9d6931984836c1ea550c32ae40f42367525"
             },
             "require": {
                 "drupal/core": "^8.8 || ^9",
@@ -4054,8 +4054,8 @@
             "type": "drupal-module",
             "extra": {
                 "drupal": {
-                    "version": "8.x-1.1",
-                    "datestamp": "1585252806",
+                    "version": "8.x-1.2",
+                    "datestamp": "1631726164",
                     "security-coverage": {
                         "status": "covered",
                         "message": "Covered by Drupal's security advisory policy"
diff --git a/vendor/composer/installed.json b/vendor/composer/installed.json
index b600ba940274c1b18e967ed6807a1ff198ea953b..834b554e360f2cb9b0931dddd2fd22088d519f1e 100644
--- a/vendor/composer/installed.json
+++ b/vendor/composer/installed.json
@@ -4156,18 +4156,18 @@
         },
         {
             "name": "drupal/entity_embed",
-            "version": "1.1.0",
-            "version_normalized": "1.1.0.0",
+            "version": "1.2.0",
+            "version_normalized": "1.2.0.0",
             "source": {
                 "type": "git",
                 "url": "https://git.drupalcode.org/project/entity_embed.git",
-                "reference": "8.x-1.1"
+                "reference": "8.x-1.2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://ftp.drupal.org/files/projects/entity_embed-8.x-1.1.zip",
-                "reference": "8.x-1.1",
-                "shasum": "f2c3f4b3071cbd69db94c5255e1db89510995b5d"
+                "url": "https://ftp.drupal.org/files/projects/entity_embed-8.x-1.2.zip",
+                "reference": "8.x-1.2",
+                "shasum": "e1d4c9d6931984836c1ea550c32ae40f42367525"
             },
             "require": {
                 "drupal/core": "^8.8 || ^9",
@@ -4179,8 +4179,8 @@
             "type": "drupal-module",
             "extra": {
                 "drupal": {
-                    "version": "8.x-1.1",
-                    "datestamp": "1585252806",
+                    "version": "8.x-1.2",
+                    "datestamp": "1631726164",
                     "security-coverage": {
                         "status": "covered",
                         "message": "Covered by Drupal's security advisory policy"
diff --git a/vendor/composer/installed.php b/vendor/composer/installed.php
index b7d14be370ff9c5bfb21b9f63a59d7cc12adf61d..57e3239c250739d5e6ce13bc24cf81d20c4c6471 100644
--- a/vendor/composer/installed.php
+++ b/vendor/composer/installed.php
@@ -5,7 +5,7 @@
         'type' => 'project',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
-        'reference' => 'd57a746ae58c15bd5b85183c4ba3713c530890ea',
+        'reference' => '7138e487735c951a87f8043af322b26866070ed0',
         'name' => 'osu-asc-webservices/d8-upstream',
         'dev' => true,
     ),
@@ -896,12 +896,12 @@
             'dev_requirement' => false,
         ),
         'drupal/entity_embed' => array(
-            'pretty_version' => '1.1.0',
-            'version' => '1.1.0.0',
+            'pretty_version' => '1.2.0',
+            'version' => '1.2.0.0',
             'type' => 'drupal-module',
             'install_path' => __DIR__ . '/../../web/modules/entity_embed',
             'aliases' => array(),
-            'reference' => '8.x-1.1',
+            'reference' => '8.x-1.2',
             'dev_requirement' => false,
         ),
         'drupal/entity_reference' => array(
@@ -2086,7 +2086,7 @@
             'type' => 'project',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
-            'reference' => 'd57a746ae58c15bd5b85183c4ba3713c530890ea',
+            'reference' => '7138e487735c951a87f8043af322b26866070ed0',
             'dev_requirement' => false,
         ),
         'pantheon-systems/quicksilver-pushback' => array(
diff --git a/web/modules/entity_embed/entity_embed.info.yml b/web/modules/entity_embed/entity_embed.info.yml
index 23026e80f1a357d7f5de83bfcf745612168e81dc..8848b19847cc86df3d300847ed72e6a55708f713 100644
--- a/web/modules/entity_embed/entity_embed.info.yml
+++ b/web/modules/entity_embed/entity_embed.info.yml
@@ -11,7 +11,7 @@ dependencies:
 test_dependencies:
   - entity_browser:entity_browser
 
-# Information added by Drupal.org packaging script on 2020-03-26
-version: '8.x-1.1'
+# Information added by Drupal.org packaging script on 2021-09-15
+version: '8.x-1.2'
 project: 'entity_embed'
-datestamp: 1585252809
+datestamp: 1631711006
diff --git a/web/modules/entity_embed/entity_embed.module b/web/modules/entity_embed/entity_embed.module
index a531922b782a9767235adc6771be3c09a2fd6e3c..2889c503b6f7ea3ac442f95087891653e1d033d3 100644
--- a/web/modules/entity_embed/entity_embed.module
+++ b/web/modules/entity_embed/entity_embed.module
@@ -207,6 +207,20 @@ function entity_embed_filter_format_edit_form_validate($form, FormStateInterface
             $missing_attributes = $required_attributes;
           }
           else {
+            // If any of the attributes on the drupal-entity tag use wildcards,
+            // iterate through and replace them with matching required
+            // attributes.
+            $wildcards = preg_grep('/\*/', array_keys($allowed['drupal-entity']));
+            if (!empty($wildcards)) {
+              foreach ($wildcards as $wildcard) {
+                $pattern = str_replace('*', '(.*)', $wildcard);
+                $matches = preg_grep('/' . $pattern . '/', $required_attributes);
+                foreach ($matches as $match) {
+                  $allowed['drupal-entity'][$match] = 1;
+                }
+                unset($allowed['drupal-entity'][$wildcard]);
+              }
+            }
             $missing_attributes = array_diff($required_attributes, array_keys($allowed['drupal-entity']));
           }
 
diff --git a/web/modules/entity_embed/js/plugins/drupalentity/plugin.js b/web/modules/entity_embed/js/plugins/drupalentity/plugin.js
index aa620e6de0a034b9ab71d5abc51198264d67c121..e5a9c4065bc6a135b163668ae07e74d7b757e98b 100644
--- a/web/modules/entity_embed/js/plugins/drupalentity/plugin.js
+++ b/web/modules/entity_embed/js/plugins/drupalentity/plugin.js
@@ -215,6 +215,7 @@
             this._loadPreview(function (widget) {
               widget._setUpDynamicEditables();
               editor.fire('unlockSnapshot');
+              editor.fire('saveSnapshot');
             });
           }
           // @todo Remove in https://www.drupal.org/project/entity_embed/issues/3060397
@@ -322,6 +323,9 @@
           jQuery.get({
             url: Drupal.url('entity-embed/preview/' + editor.config.drupal.format + '?text=' + encodeURIComponent(this.downcast().getOuterHtml())),
             dataType: 'html',
+            headers: {
+              'X-Drupal-EntityPreview-CSRF-Token': editor.config.drupalEntity_previewCsrfToken,
+            }
           }).done(function(previewHtml) {
             widget.element.setHtml(previewHtml);
             callback(widget);
diff --git a/web/modules/entity_embed/src/Controller/PreviewController.php b/web/modules/entity_embed/src/Controller/PreviewController.php
index 33102d9a14eae966e32979de7f017c1c55d4156b..e6bc8ab2adb350072556a061733afa49776f826b 100644
--- a/web/modules/entity_embed/src/Controller/PreviewController.php
+++ b/web/modules/entity_embed/src/Controller/PreviewController.php
@@ -4,10 +4,12 @@
 
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
 use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Session\AccountInterface;
 use Drupal\filter\FilterFormatInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -62,6 +64,8 @@ public static function create(ContainerInterface $container) {
    * @see \Drupal\editor\EditorController::getUntransformedText
    */
   public function preview(Request $request, FilterFormatInterface $filter_format) {
+    self::checkCsrf($request, \Drupal::currentUser());
+
     $text = $request->get('text');
     if ($text == '') {
       throw new NotFoundHttpException();
@@ -86,4 +90,30 @@ public function preview(Request $request, FilterFormatInterface $filter_format)
       ->setMaxAge(300);
   }
 
+  /**
+   * Throws an AccessDeniedHttpException if the request fails CSRF validation.
+   *
+   * This is used instead of \Drupal\Core\Access\CsrfAccessCheck, in order to
+   * allow access for anonymous users.
+   *
+   * @todo Refactor this to an access checker.
+   */
+  private static function checkCsrf(Request $request, AccountInterface $account) {
+    $header = 'X-Drupal-EntityPreview-CSRF-Token';
+
+    if (!$request->headers->has($header)) {
+      throw new AccessDeniedHttpException();
+    }
+    if ($account->isAnonymous()) {
+      // For anonymous users, just the presence of the custom header is
+      // sufficient protection.
+      return;
+    }
+    // For authenticated users, validate the token value.
+    $token = $request->headers->get($header);
+    if (!\Drupal::csrfToken()->validate($token, $header)) {
+      throw new AccessDeniedHttpException();
+    }
+  }
+
 }
diff --git a/web/modules/entity_embed/src/Entity/EntityEmbedFakeEntity.php b/web/modules/entity_embed/src/Entity/EntityEmbedFakeEntity.php
index 34241cc61dd3fe3a8d64b7aa70e77633ea449372..078eb67a0fca6ce6fb587003cd8b127add1da268 100644
--- a/web/modules/entity_embed/src/Entity/EntityEmbedFakeEntity.php
+++ b/web/modules/entity_embed/src/Entity/EntityEmbedFakeEntity.php
@@ -13,6 +13,7 @@
  *   handlers = {
  *     "storage" = "Drupal\Core\Entity\ContentEntityNullStorage",
  *   },
+ *   internal = true,
  * )
  */
 class EntityEmbedFakeEntity extends ContentEntityBase {
diff --git a/web/modules/entity_embed/src/Plugin/CKEditorPlugin/DrupalEntity.php b/web/modules/entity_embed/src/Plugin/CKEditorPlugin/DrupalEntity.php
index 6e71eaadbac2ed6349fad69302fa949d7b9dcd33..236e8da431553a8bb741084132a6ba0a774f2a8f 100644
--- a/web/modules/entity_embed/src/Plugin/CKEditorPlugin/DrupalEntity.php
+++ b/web/modules/entity_embed/src/Plugin/CKEditorPlugin/DrupalEntity.php
@@ -53,6 +53,7 @@ public function getConfig(Editor $editor) {
       'DrupalEntity_dialogTitleAdd' => t('Insert entity'),
       'DrupalEntity_dialogTitleEdit' => t('Edit entity'),
       'DrupalEntity_buttons' => $this->getButtons(),
+      'drupalEntity_previewCsrfToken' => \Drupal::csrfToken()->get('X-Drupal-EntityPreview-CSRF-Token'),
     ];
   }
 
diff --git a/web/modules/entity_embed/tests/modules/entity_embed_test/entity_embed_test.info.yml b/web/modules/entity_embed/tests/modules/entity_embed_test/entity_embed_test.info.yml
index 2c0ac91d49902d1d6d6a6345303c1f9ed929abb4..8945177927f2a4d58dc5652d7c1cc9ec5d5eeeed 100644
--- a/web/modules/entity_embed/tests/modules/entity_embed_test/entity_embed_test.info.yml
+++ b/web/modules/entity_embed/tests/modules/entity_embed_test/entity_embed_test.info.yml
@@ -13,7 +13,7 @@ dependencies:
  - embed:embed
  - entity_embed:entity_embed
 
-# Information added by Drupal.org packaging script on 2020-03-26
-version: '8.x-1.1'
+# Information added by Drupal.org packaging script on 2021-09-15
+version: '8.x-1.2'
 project: 'entity_embed'
-datestamp: 1585252809
+datestamp: 1631711006
diff --git a/web/modules/entity_embed/tests/modules/entity_embed_translation_test/entity_embed_translation_test.info.yml b/web/modules/entity_embed/tests/modules/entity_embed_translation_test/entity_embed_translation_test.info.yml
index 3daeda6ddd73e5177e985a807b9b6d9c17566518..fa9cc1446215dc185d937a644f3ecf95b770ea65 100644
--- a/web/modules/entity_embed/tests/modules/entity_embed_translation_test/entity_embed_translation_test.info.yml
+++ b/web/modules/entity_embed/tests/modules/entity_embed_translation_test/entity_embed_translation_test.info.yml
@@ -14,7 +14,7 @@ dependencies:
  - embed:embed
  - entity_embed:entity_embed
 
-# Information added by Drupal.org packaging script on 2020-03-26
-version: '8.x-1.1'
+# Information added by Drupal.org packaging script on 2021-09-15
+version: '8.x-1.2'
 project: 'entity_embed'
-datestamp: 1585252809
+datestamp: 1631711006
diff --git a/web/modules/entity_embed/tests/src/Functional/EntityEmbedDisplayManagerTest.php b/web/modules/entity_embed/tests/src/Functional/EntityEmbedDisplayManagerTest.php
index dbd5067cd41164d85a415460bda37247b601edcb..c1e1bded55279fc6fc13eb0ce06ec2ae261ddc29 100644
--- a/web/modules/entity_embed/tests/src/Functional/EntityEmbedDisplayManagerTest.php
+++ b/web/modules/entity_embed/tests/src/Functional/EntityEmbedDisplayManagerTest.php
@@ -10,6 +10,11 @@
  */
 class EntityEmbedDisplayManagerTest extends BrowserTestBase {
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
   /**
    * {@inheritdoc}
    */
diff --git a/web/modules/entity_embed/tests/src/Functional/EntityEmbedTestBase.php b/web/modules/entity_embed/tests/src/Functional/EntityEmbedTestBase.php
index c92bcecd6b737e7538a429117da866c51df93ff9..5bebea69e80a32c25f79f9542565bd37330fba5c 100644
--- a/web/modules/entity_embed/tests/src/Functional/EntityEmbedTestBase.php
+++ b/web/modules/entity_embed/tests/src/Functional/EntityEmbedTestBase.php
@@ -16,6 +16,11 @@ abstract class EntityEmbedTestBase extends BrowserTestBase {
 
   use TestFileCreationTrait;
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
   /**
    * Modules to enable.
    *
diff --git a/web/modules/entity_embed/tests/src/Functional/EntityReferenceFieldFormatterTest.php b/web/modules/entity_embed/tests/src/Functional/EntityReferenceFieldFormatterTest.php
index 397b2ecaba99468dd2c54872afe4eca8130c0213..b78b51d88bfd09a0f76cf8c3f6fdbf49fe54b348 100644
--- a/web/modules/entity_embed/tests/src/Functional/EntityReferenceFieldFormatterTest.php
+++ b/web/modules/entity_embed/tests/src/Functional/EntityReferenceFieldFormatterTest.php
@@ -93,7 +93,7 @@ public function testEntityReferenceFieldFormatter() {
     // Ensure that 'Rendered Entity' plugin is not available for an entity not
     // having a view controller.
     $plugin_options = $this->container->get('plugin.manager.entity_embed.display')->getDefinitionOptionsForEntity($this->menu);
-    $this->assertFalse(array_key_exists('entity_reference:entity_reference_entity_view', $plugin_options), "The 'Rendered entity' plugin is not available.");
+    $this->assertArrayNotHasKey('entity_reference:entity_reference_entity_view', $plugin_options, "The 'Rendered entity' plugin is not available.");
   }
 
   /**
diff --git a/web/modules/entity_embed/tests/src/Functional/ViewModeFieldFormatterTest.php b/web/modules/entity_embed/tests/src/Functional/ViewModeFieldFormatterTest.php
index cab2e3f44fd08a3e3ad873101e64adb479379db7..72079146a1ad56409d948d176f149f084afe8a9d 100644
--- a/web/modules/entity_embed/tests/src/Functional/ViewModeFieldFormatterTest.php
+++ b/web/modules/entity_embed/tests/src/Functional/ViewModeFieldFormatterTest.php
@@ -11,6 +11,11 @@
  */
 class ViewModeFieldFormatterTest extends EntityEmbedTestBase {
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'classy';
+
   private $plugins = [
     'view_mode:node.full',
     'view_mode:node.rss',
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/ButtonAdminTest.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/ButtonAdminTest.php
index 4ed8503e86385058f602f3e11dffaa5cb8351f32..272dda523e1068f783b9dcf069f7dee4b5bbc3a1 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/ButtonAdminTest.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/ButtonAdminTest.php
@@ -14,6 +14,11 @@ class ButtonAdminTest extends WebDriverTestBase {
 
   use MediaTypeCreationTrait;
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
   /**
    * {@inheritdoc}
    */
@@ -98,7 +103,7 @@ public function testEmbedButtonAdmin($entity_type_id, $bundle_id, $entity_embed_
     $page->checkField('type_settings[display_plugins][' . $entity_embed_display_plugin_id . ']');
     $page->pressButton('Save');
 
-    $this->assertContains('The embed button ' . $entity_type_id . ' has been added.', $page->getText());
+    $this->assertStringContainsString('The embed button ' . $entity_type_id . ' has been added.', $page->getText());
     $this->assertSession()->linkByHrefExists('/admin/config/content/embed/button/manage/' . $entity_type_id);
 
     $this->drupalGet('/admin/config/content/embed/button/manage/' . $entity_type_id);
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/CKEditorIntegrationTest.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/CKEditorIntegrationTest.php
index c4d97df4f41e9f4eb15c912ac5c4fe38d03db0b9..a2a4167a8e2503556c2911006fe76068f5446fc2 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/CKEditorIntegrationTest.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/CKEditorIntegrationTest.php
@@ -26,6 +26,11 @@ class CKEditorIntegrationTest extends EntityEmbedTestBase {
     'entity_embed_test',
   ];
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
   /**
    * The test button.
    *
@@ -152,7 +157,7 @@ public function testIntegration() {
 
     // Verify the <drupal-entity> tag is not yet allowed.
     $allowed_html = $this->assertSession()->fieldExists('filters[filter_html][settings][allowed_html]')->getValue();
-    $this->assertNotContains('drupal-entity', $allowed_html);
+    $this->assertStringNotContainsString('drupal-entity', $allowed_html);
 
     // Verify that after dragging the Entity Embed CKEditor plugin button into
     // the active toolbar, the <drupal-entity> tag is allowed, as well as some
@@ -166,7 +171,7 @@ public function testIntegration() {
     $allowed_html_updated = $this->assertSession()
       ->fieldExists('filters[filter_html][settings][allowed_html]')
       ->getValue();
-    $this->assertContains('drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button', $allowed_html_updated);
+    $this->assertStringContainsString('drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button', $allowed_html_updated);
 
     $this->assertSession()->buttonExists('Save configuration')->press();
     $this->assertSession()->responseContains('The text format <em class="placeholder">Embed format</em> has been updated.');
@@ -177,7 +182,7 @@ public function testIntegration() {
     $settings = $filterFormat->filters('filter_html')->settings;
     $allowed_html = $settings['allowed_html'];
 
-    $this->assertContains('drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button', $allowed_html);
+    $this->assertStringContainsString('drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button', $allowed_html);
 
     // Verify that the Entity Embed button shows up and results in an
     // operational entity embedding experience in the text editor.
@@ -206,7 +211,7 @@ public function testIntegration() {
     $this->getSession()->switchToIFrame('ckeditor');
     $this->assertSession()->pageTextContains('Billy Bones');
     $this->getSession()->switchToIFrame();
-    $this->assertSame(3, $this->getCkeditorUndoSnapshotCount());
+    $this->assertSame(4, $this->getCkeditorUndoSnapshotCount());
     $this->getSession()
       ->getPage()
       ->find('css', 'input[name="title[0][value]"]')
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/ConfigurationUiTest.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/ConfigurationUiTest.php
index 319863fbfeeaae964543593c1b34d11499361919..e23bb50417c7835572b8463e4cd5afb116d29b91 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/ConfigurationUiTest.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/ConfigurationUiTest.php
@@ -119,7 +119,7 @@ public function testValidationWhenAdding($filter_html_status, $entity_embed_stat
       // Unfortunately the <drupal-entity> tag is not yet allowed due to
       // https://www.drupal.org/project/drupal/issues/2763075.
       $allowed_html = $this->assertSession()->fieldExists('filters[filter_html][settings][allowed_html]')->getValue();
-      $this->assertNotContains('drupal-entity', $allowed_html);
+      $this->assertStringNotContainsString('drupal-entity', $allowed_html);
     }
     elseif (!empty($allowed_html)) {
       $page->fillField('filters[filter_html][settings][allowed_html]', $allowed_html);
@@ -193,7 +193,7 @@ public function testValidationWhenEditing($filter_html_status, $entity_embed_sta
 
     if ($allowed_html == 'default' && $entity_embed_status) {
       $allowed_html = $this->assertSession()->fieldExists('filters[filter_html][settings][allowed_html]')->getValue();
-      $this->assertContains('drupal-entity', $allowed_html);
+      $this->assertStringContainsString('drupal-entity', $allowed_html);
     }
     elseif (!empty($allowed_html)) {
       $page->fillField('filters[filter_html][settings][allowed_html]', $allowed_html);
@@ -260,6 +260,12 @@ public function providerTestValidations() {
         'allowed_html' => "<a href hreflang> <em> <strong> <cite> <blockquote cite> <code> <ul type> <ol start type='1 A I'> <li> <dl> <dt> <dd> <h2 id='jump-*'> <h3 id> <h4 id> <h5 id> <h6 id> <drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-embed-button data-langcode>",
         'expected_error_message' => 'The <drupal-entity> tag in the allowed HTML tags is missing the following attributes: data-caption, alt, title.',
       ],
+      'Tests that wildcard for required attributes works' => [
+        'filters[filter_html][status]' => TRUE,
+        'filters[entity_embed][status]' => TRUE,
+        'allowed_html' => "<a href hreflang> <em> <strong> <cite> <blockquote cite> <code> <ul type> <ol start type='1 A I'> <li> <dl> <dt> <dd> <h2 id='jump-*'> <h3 id> <h4 id> <h5 id> <h6 id> <drupal-entity data-* alt title>",
+        'expected_error_message' => FALSE,
+      ],
     ];
   }
 
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/ContentTranslationTest.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/ContentTranslationTest.php
index 5e9749a0b9a8f9ff22690640d792d37d1758498f..86c579ccad6a3cea4aa8f6cc5e16f2e6abbfb494 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/ContentTranslationTest.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/ContentTranslationTest.php
@@ -133,12 +133,12 @@ public function testHostEntityLangcode() {
 
     // Assert autocomplete suggestions are in host entity language (en).
     $suggestions = $this->getAutocompleteSuggestions('clar');
-    $this->assertContains('Clark Kent', $suggestions);
+    $this->assertStringContainsString('Clark Kent', $suggestions);
 
     // Assert autocomplete does not show suggestions for translations not
     // matching the host entity language.
     $suggestions = $this->getAutocompleteSuggestions('super');
-    $this->assertNotContains('Superhomme', $suggestions);
+    $this->assertStringNotContainsString('Superhomme', $suggestions);
 
     // Select the suggestion matching the host entity language, and proceed to
     // the review step.
@@ -151,8 +151,8 @@ public function testHostEntityLangcode() {
     // Assert that the review step displays the selected entity with the label
     // in the host language.
     $text = $form->getText();
-    $this->assertContains('Clark Kent', $text);
-    $this->assertNotContains('Superhomme', $text);
+    $this->assertStringContainsString('Clark Kent', $text);
+    $this->assertStringNotContainsString('Superhomme', $text);
 
     // Repeat the same test pattern, but now for a Media entity instead of Node.
     $this->getSession()->reload();
@@ -163,12 +163,12 @@ public function testHostEntityLangcode() {
 
     // Assert autocomplete suggestions are in host entity language (en).
     $suggestions = $this->getAutocompleteSuggestions('Smeagol likes cheese');
-    $this->assertContains('Smeagol likes cheese', $suggestions);
+    $this->assertStringContainsString('Smeagol likes cheese', $suggestions);
 
     // Assert autocomplete does not show suggestions for translations not
     // matching the host entity language.
     $suggestions = $this->getAutocompleteSuggestions("Gollum n'aime que la bague");
-    $this->assertNotContains("Gollum n'aime que la bague", $suggestions);
+    $this->assertStringNotContainsString("Gollum n'aime que la bague", $suggestions);
 
     // Select the suggestion matching the host entity language, and proceed to
     // the review step.
@@ -181,8 +181,8 @@ public function testHostEntityLangcode() {
     // Assert that the review step displays the selected entity with the label
     // in the host language.
     $text = $form->getText();
-    $this->assertContains('Smeagol likes cheese', $text);
-    $this->assertNotContains("Gollum n'aime que la bague", $text);
+    $this->assertStringContainsString('Smeagol likes cheese', $text);
+    $this->assertStringNotContainsString("Gollum n'aime que la bague", $text);
 
     // Get translation of host entity.
     $this->drupalGet('/fr/node/' . $host->id() . '/edit');
@@ -192,12 +192,12 @@ public function testHostEntityLangcode() {
 
     // Assert autocomplete suggestions are in host entity language (fr).
     $suggestions = $this->getAutocompleteSuggestions('super');
-    $this->assertContains('Superhomme', $suggestions);
+    $this->assertStringContainsString('Superhomme', $suggestions);
 
     // Assert autocomplete does not show suggestions for translations not
     // matching the host entity language.
     $suggestions = $this->getAutocompleteSuggestions('clark');
-    $this->assertNotContains('Clark Kent', $suggestions);
+    $this->assertStringNotContainsString('Clark Kent', $suggestions);
 
     // Select the suggestion matching the host entity language, and proceed to
     // the review step.
@@ -209,8 +209,8 @@ public function testHostEntityLangcode() {
 
     // Assert the translated label appears, not the original.
     $text = $form->getText();
-    $this->assertContains('Superhomme', $text);
-    $this->assertNotContains('Clark Kent', $text);
+    $this->assertStringContainsString('Superhomme', $text);
+    $this->assertStringNotContainsString('Clark Kent', $text);
 
     // Choose to display as label without link.
     $this->assertSession()
@@ -238,12 +238,12 @@ public function testHostEntityLangcode() {
 
     // Assert autocomplete suggestions are in host entity language (fr).
     $suggestions = $this->getAutocompleteSuggestions("Gollum n'aime que la bague");
-    $this->assertContains("Gollum n'aime que la bague", $suggestions);
+    $this->assertStringContainsString("Gollum n'aime que la bague", $suggestions);
 
     // Assert autocomplete does not show suggestions for translations not
     // matching the host entity language.
     $suggestions = $this->getAutocompleteSuggestions('Smeagol likes cheese');
-    $this->assertNotContains('Smeagol likes cheese', $suggestions);
+    $this->assertStringNotContainsString('Smeagol likes cheese', $suggestions);
 
     // Select the suggestion matching the host entity language, and proceed to
     // the review step.
@@ -255,8 +255,8 @@ public function testHostEntityLangcode() {
 
     // Assert the translated label appears, not the original.
     $text = $form->getText();
-    $this->assertContains("Gollum n'aime que la bague", $text);
-    $this->assertNotContains('Smeagol likes cheese', $text);
+    $this->assertStringContainsString("Gollum n'aime que la bague", $text);
+    $this->assertStringNotContainsString('Smeagol likes cheese', $text);
 
     // Choose to display as thumbnail with 'medium' image style.
     $this->assertSession()
@@ -274,7 +274,7 @@ public function testHostEntityLangcode() {
     $this->assignNameToCkeditorIframe();
     $this->getSession()->switchToIFrame('ckeditor');
     $img = $this->assertSession()->elementExists('css', 'img');
-    $this->assertContains('Smeagol.jpg', $img->getAttribute('src'));
+    $this->assertStringContainsString('Smeagol.jpg', $img->getAttribute('src'));
     $this->assertEquals("Gollum n'aime que la bague alt", $img->getAttribute('alt'));
 
     // Save the host entity, verify that it also shows up the same way on the
@@ -283,7 +283,7 @@ public function testHostEntityLangcode() {
     $this->getSession()->switchToIFrame();
     $this->assertSession()->buttonExists('Save')->press();
     $img = $this->assertSession()->elementExists('css', 'img');
-    $this->assertContains('Smeagol.jpg', $img->getAttribute('src'));
+    $this->assertStringContainsString('Smeagol.jpg', $img->getAttribute('src'));
     $this->assertEquals("Gollum n'aime que la bague alt", $img->getAttribute('alt'));
 
     // Verify that editing the host entity and then triggering the Entity Embed
@@ -299,8 +299,8 @@ public function testHostEntityLangcode() {
     $this->assertSession()->assertWaitOnAjaxRequest();
     $form = $this->assertSession()->waitForElementVisible('css', 'form.entity-embed-dialog-step--embed');
     $text = $form->getText();
-    $this->assertContains("Gollum n'aime que la bague", $text);
-    $this->assertNotContains('Smeagol likes cheese', $text);
+    $this->assertStringContainsString("Gollum n'aime que la bague", $text);
+    $this->assertStringNotContainsString('Smeagol likes cheese', $text);
 
     // Close the Entity Embed Dialog, and enter CKEditor's "source" mode.
     $this->assertSession()->elementExists('css', '.ui-dialog-titlebar-close')->press();
@@ -326,7 +326,7 @@ public function testHostEntityLangcode() {
 
     // Assert that the image appears with correct alt text (en).
     $img = $this->assertSession()->waitForElementVisible('css', 'img');
-    $this->assertContains('Smeagol.jpg', $img->getAttribute('src'));
+    $this->assertStringContainsString('Smeagol.jpg', $img->getAttribute('src'));
     $this->assertEquals("Smeagol likes cheese alt", $img->getAttribute('alt'));
 
     // Save the host entity, verify that it also shows up the same way on the
@@ -337,7 +337,7 @@ public function testHostEntityLangcode() {
 
     // Assert that the image appears with correct alt text.
     $img = $this->assertSession()->elementExists('css', 'img');
-    $this->assertContains('Smeagol.jpg', $img->getAttribute('src'));
+    $this->assertStringContainsString('Smeagol.jpg', $img->getAttribute('src'));
     $this->assertEquals("Smeagol likes cheese alt", $img->getAttribute('alt'));
   }
 
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/EntityEmbedTestBase.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/EntityEmbedTestBase.php
index 03283f2c7522b1d91fdb38e331ecf3c38f48d4f1..d90f374b59c3cd5ad8d8897811f613cc6a2eb282 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/EntityEmbedTestBase.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/EntityEmbedTestBase.php
@@ -9,6 +9,11 @@
  */
 abstract class EntityEmbedTestBase extends WebDriverTestBase {
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
   /**
    * {@inheritdoc}
    */
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/ImageFieldFormatterTest.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/ImageFieldFormatterTest.php
index 47e95ba851ac3eef6f27fd450f45ab41271295a5..cb864aa81be6e30d9786d22c710add3f4335cedd 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/ImageFieldFormatterTest.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/ImageFieldFormatterTest.php
@@ -15,6 +15,11 @@ class ImageFieldFormatterTest extends WebDriverTestBase {
 
   use SortableTestTrait;
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
   /**
    * {@inheritdoc}
    */
@@ -179,7 +184,7 @@ public function testInvalidImageError() {
     $settings = $filterFormat->filters('filter_html')->settings;
     $allowed_html = $settings['allowed_html'];
 
-    $this->assertContains('drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button data-langcode alt title', $allowed_html);
+    $this->assertStringContainsString('drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button data-langcode alt title', $allowed_html);
 
     $this->drupalGet('/node/add/page');
     $this->assertSession()->waitForElement('css', 'a.cke_button__' . $this->button->id())->click();
@@ -210,7 +215,7 @@ public function testInvalidImageError() {
     $this->assertEquals('Hello world alt text', $drupal_entity->getAttribute('alt'));
     $this->assertEquals('Hello world title text', $drupal_entity->getAttribute('title'));
     $image = $drupal_entity->find('css', 'img');
-    $this->assertContains('rainbow-kitten.png', $image->getAttribute('src'));
+    $this->assertStringContainsString('rainbow-kitten.png', $image->getAttribute('src'));
     $this->getSession()->switchToIFrame();
 
     $this->assertSession()->fieldExists('title[0][value]')->setValue('Testing Page with Embed');
@@ -219,7 +224,7 @@ public function testInvalidImageError() {
     $wrapper = $this->assertSession()
       ->elementExists('xpath', "//div[contains(@data-embed-button, 'image_embed')]");
     $img = $wrapper->find('css', 'img');
-    $this->assertContains('rainbow-kitten.png', $img->getAttribute('src'));
+    $this->assertStringContainsString('rainbow-kitten.png', $img->getAttribute('src'));
     $this->assertEquals('Hello world alt text', $img->getAttribute('alt'));
     $this->assertEquals('Hello world title text', $img->getAttribute('title'));
 
diff --git a/web/modules/entity_embed/tests/src/FunctionalJavascript/MediaImageTest.php b/web/modules/entity_embed/tests/src/FunctionalJavascript/MediaImageTest.php
index c4bb77fd582d5c8229b38f8509b235a4a2efec3d..73fa189deb8a061355112f48d89fd1af088ad476 100644
--- a/web/modules/entity_embed/tests/src/FunctionalJavascript/MediaImageTest.php
+++ b/web/modules/entity_embed/tests/src/FunctionalJavascript/MediaImageTest.php
@@ -42,6 +42,11 @@ class MediaImageTest extends EntityEmbedTestBase {
    */
   protected $host;
 
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stable';
+
   /**
    * {@inheritdoc}
    */
@@ -117,7 +122,7 @@ public function testAltAndTitle() {
 
     // Assert that the review step displays the selected entity with the label.
     $text = $form->getText();
-    $this->assertContains('Red-lipped batfish', $text);
+    $this->assertStringContainsString('Red-lipped batfish', $text);
 
     $select = $this->assertSession()
       ->selectExists('attributes[data-entity-embed-display]');
@@ -158,7 +163,7 @@ public function testAltAndTitle() {
 
     // Assert that the review step displays the selected entity with the label.
     $text = $form->getText();
-    $this->assertContains('Screaming hairy armadillo', $text);
+    $this->assertStringContainsString('Screaming hairy armadillo', $text);
 
     $select = $this->assertSession()
       ->selectExists('attributes[data-entity-embed-display]');
@@ -503,8 +508,8 @@ public function testCkeditorWidgetHasEditableCaption() {
     $this->pressEditorButton('source');
     $source = $this->assertSession()->elementExists('css', "textarea.cke_source");
     $value = $source->getValue();
-    $this->assertContains('https://www.drupal.org/project/drupal', $value);
-    $this->assertNotContains('data-cke-saved-href', $value);
+    $this->assertStringContainsString('https://www.drupal.org/project/drupal', $value);
+    $this->assertStringNotContainsString('data-cke-saved-href', $value);
 
     // Save the entity.
     $this->assertSession()->buttonExists('Save')->press();
diff --git a/web/modules/entity_embed/tests/src/Kernel/EntityEmbedFilterTestBase.php b/web/modules/entity_embed/tests/src/Kernel/EntityEmbedFilterTestBase.php
index fa0bc0a6e77f499ef306de112bc57e5067527c6f..43e287fc5a24c84b86983f63477ba7fe2e97d115 100644
--- a/web/modules/entity_embed/tests/src/Kernel/EntityEmbedFilterTestBase.php
+++ b/web/modules/entity_embed/tests/src/Kernel/EntityEmbedFilterTestBase.php
@@ -122,12 +122,12 @@ protected function createEmbedCode(array $attributes) {
    * @see \Drupal\KernelTests\AssertContentTrait::setRawContent()
    */
   protected function applyFilter($text, $langcode = 'en') {
-    $this->assertContains('<drupal-entity', $text);
-    $this->assertContains('This placeholder should not be rendered.', $text);
+    $this->assertStringContainsString('<drupal-entity', $text);
+    $this->assertStringContainsString('This placeholder should not be rendered.', $text);
     $filter_result = $this->processText($text, $langcode);
     $output = $filter_result->getProcessedText();
-    $this->assertNotContains('<drupal-entity', $output);
-    $this->assertNotContains('This placeholder should not be rendered.', $output);
+    $this->assertStringNotContainsString('<drupal-entity', $output);
+    $this->assertStringNotContainsString('This placeholder should not be rendered.', $output);
     $this->setRawContent($output);
     return $filter_result;
   }