Drupal 10 ends December 9, 2026: your Drupal 11 upgrade checklist

Drupal 10 stops receiving security fixes the week of December 9, 2026. After that, the Drupal Security Team publishes no more advisories or patches for it, even for a serious flaw found the following day. For most sites the move to Drupal 11 is the smoothest major upgrade Drupal has had, but only if the preparation starts now rather than in the last week of November.

Where does your site stand?

An administrator can see the exact version under Reports, Status report. Then find your line in this table:

What Drupal 11 needs

The server changes can usually be made before the Drupal upgrade, because Drupal 10.6 also runs on PHP 8.3. Doing them first means the upgrade itself changes only one thing at a time.

The upgrade checklist

1. Install the Upgrade Status module on a non-production copy. It lists every contributed module and custom module that is not ready for Drupal 11, and the deprecated code each one uses.
2. Sort the contributed modules into three groups: ready (update to a Drupal 11 compatible release), not ready but maintained (check the module's issue queue for a release date or patch), and abandoned (find a replacement or remove it).
3. Fix custom modules and themes. Most changes are mechanical replacements of deprecated code, and the Drupal Rector tool automates many of them. Your developers, or eWay, will need to review what it changes.
4. Remove what you do not use. Every disabled module, unused theme, and old feature you remove is one less thing to upgrade.
5. Update the server stack to PHP 8.3 or newer and a supported database, and test the site on Drupal 10.6 first.
6. Run the upgrade on a copy with Composer, run the database updates, and export the configuration.
7. Test what your visitors and editors use: forms, search, sign-in, editing and publishing, media uploads, views and listings, and any integration with another system.
8. Schedule the production upgrade with a recent backup and a tested way back.

Drupal 12 is expected around the same time Drupal 10 ends. You do not need to wait for it: Drupal 11 will be supported well beyond that, and moving to 11 now keeps the next upgrade small.

Still on Drupal 7?

Drupal 7 reached community end of life on January 5, 2025. Some hosts and vendors offer paid or bundled extended support, but these programs have end dates too; Pantheon's, for example, runs to January 5, 2027. Moving from Drupal 7 to Drupal 11 is a rebuild: new theme, content migrated with Drupal's migration tools, and custom features redeveloped. Plan it as a project with its own budget and timeline, not as an update.

A note for government agencies and universities

Running unsupported software often conflicts with security policies, audits, and cyber insurance terms, and some agencies must report it. If the upgrade cannot finish before December 9, document the plan and the date, keep the site on the latest 10.6 release, and tighten other protections such as the web application firewall in the meantime.

How eWay handles Drupal upgrades

For Drupal sites eWay manages, compatibility analysis starts well before each major release: an inventory of contributed and custom code, an upgrade assessment, and a plan. PHP, database, and server versions are moved in step with what Drupal supports and validated in a test environment first. Upgrades go through staging, with a regression check of rendering, sign-in, search, and forms, and every production change has a tested rollback.

What to include in a support ticket

• The site and its current Drupal version (from the Status report)
• Any deadline from your organization, such as an audit or a contract date
• Modules or features you know you no longer need
• Who on your side will test and approve the upgrade

eWay customers can open a ticket in the support portal or email support@ewaycorp.com. Related reading: Drupal security updates and patch cadence, preparing for a PHP version upgrade, and structuring Drupal environments.