What happens on December 9
Drupal 10.6.x is the only Drupal 10 branch still receiving security fixes. After December 9, 2026, the Drupal community will stop releasing core patches for all versions of Drupal 10. Unsupported sites will still stay online after December 9th, but each unpatched vulnerability discovered after that date adds to the site risks. Drupal 12.0 and 11.5 are scheduled to be released the same week. Security support for 11.3.x will also end that week. See the Drupal core release schedule for more details.
What’s new in Drupal 11
Performance
Drupal 11 includes several performance improvements. Drupal 11.4 used just over a third as many database and cache lookups as 10.6 in testing. Drupal 11.3 also moved BigPipe to HTMX, cutting the JavaScript it needs to fill in slower parts of a page. Benchmark a few pages you care about, such as a search results page and a logged-in editor screen, before and after the upgrade.
See Drupal 11.4 performance notes and Drupal 11.3 performance notes
Drupal Canvas
Drupal Canvas lets editors build pages from approved components and see the visual layout as they work. It’s the default editor experience for page building in Drupal CMS 2.x and is available as a module for Drupal 11 sites. Try it on one landing page first so you can see how your theme, components and editorial permissions fit in.
See Drupal Canvas and Drupal CMS 2.0 release announcement
Recipies
Recipes let site builders apply a repeatable set of modules and settings, such as the setup for a new content type. Drupal CMS also offers optional AI tools for tasks such as drafting image alt text. Decide who reviews the output and which content the tool may send to a provider before enabling it.
See Drupal Recipes documentation and Drupal CMS AI features
Upgrade paths for Drupal 7 through 10
| Version | Security priority | Typical effort | Options |
|---|---|---|---|
| Drupal 7 | Urgent priority. Support for Drupal 7 ended Jan. 5, 2025 with several known active vulnerabilities. | High for Drupal 11. Backdrop effort varies by site and available modules. | There is no reliable upgrade path from Drupal 7 to 11. Migrate to a new Drupal 11 site or move to Backdrop CMS. |
| Drupal 8 | High priority. Support ended Nov. 17, 2021. | High. Three major upgrades in place. | Upgrade 8.9 → 9.5 → 10.6 → 11.4, or rebuild on Drupal CMS. |
| Drupal 9 | High priority. Support ended Nov. 1, 2023. | Moderate to high. Two major upgrades in place. | Upgrade 9.5 → 10.6 → 11.4, or rebuild on Drupal CMS. |
| Drupal 10 | High on 10.5 and earlier. 10.6 ends Dec. 9, 2026. | Low to moderate. Custom code may add additional effort. | Upgrade to 11.4.x, or launch a Drupal CMS rebuild if it is ready before the deadline. |
Audit the site before you schedule the upgrade
Before you run the Drupal 11 upgrade, run through your site to verify compatibility of custom code, contributed modules and hosting requirements.
- Custom code. Scan a local or staging copy of your Drupal 10 site for deprecated APIs in custom modules and themes. Include integrations and any patches you maintain. Review Composer constraints on Symfony packages, since Drupal 11.4 uses Symfony 7.4.
- Contributed and removed modules. Check the contributed modules and themes your site depends on for stable Drupal 11 releases. Look for removed core modules such as Book and Statistics. Decide whether to remove each dependency or replace it before upgrading. Drupal 10 to 11 upgrade guide
- Hosting. Confirm that your hosting environments including staging and production can run PHP 8.3 or later for Drupal 11.4. Check the database version, required PHP extensions, Composer and Drush. Ask your host how long a database restore takes. PHP compatibility · Database requirements
- Deployment. Test the upgrade on a staging environment first and verify that the database update process runs successfully. Test all critical path features. Have an editor publish a page. Submit a form and confirm the email arrives. Test sign-in, search and any integration your team relies on.
Upgrade the current site or rebuild with Drupal CMS
Upgrade in place if the site still meets your needs and the staging upgrade passes. Consider a Drupal CMS rebuild if editors struggle to publish, your content model needs major changes, or custom code has become too expensive to maintain. A rebuild still needs a content migration, redirect testing and a launch plan. With about four weeks left, count on a rebuild for the December deadline only if a tested replacement is nearly ready.
Run the audit this week. If the staging upgrade passes, book production deployment for the first week of December so there’s time to recover from a failed release. If a blocker puts December 9 out of reach, keep 10.6.x on its latest available patch, ask what temporary security coverage you can arrange, and assign an owner and date to move off Drupal 10.
If you’re already on Drupal 11
If you’re on 11.3 or earlier, move to 11.4 or a newer supported release. Drupal 11 has security support into December 2028 if you keep up with minor releases. Release schedule
Before moving to Drupal 12, run Upgrade Status again and test on PHP 8.5. Check your database and Symfony 8 compatibility, especially if Composer pins dependencies. Rehearse the upgrade on staging once Drupal 12 is stable. Drupal 12 upgrade guide · Platform requirements · Symfony dependencies
If you’re unsure whether you can make the deadline, send us your Drupal version and the features your site depends on. We’ll help you work out what needs attention first.