Drupal 10 Ends Dec 9, 2026: Are You Ready for Drupal 12?
A client of mine once ran their CMS strategy on “we’ll deal with it when it breaks.” That worked for six years, until they discovered a commerce integration depended on a library that had stopped receiving security patches fourteen months earlier. Drupal is about to hand every team on version 10 the same decision, except this time the date is published and there’s no excuse for finding out late.
Drupal 12 ships the week of December 7, 2026. Drupal 10 reaches end of life two days later, on December 9. Those dates landing in the same week aren’t a coincidence; it’s how Drupal’s release cycle works, and it gives every team on Drupal 10 a fixed runway rather than a vague warning.
- Drupal 12 ships the week of Dec 7, 2026
- Drupal 10 EOL: Dec 9, 2026
- Already on Drupal 11? Land on 11.5 first
- Action item: start the custom-code audit now
When Does Drupal 12 Actually Ship, and When Does Drupal 10 End?
Per Drupal core’s release schedule (last updated mid-July 2026):
Milestone | Date |
Drupal 11.4.0 released; security support ends for 11.2.x, 10.5.x | Week of June 29, 2026 |
Drupal 12 beta requirements finalized | September 11, 2026 |
Drupal 12.0.0-beta1 / 11.5.0-beta1 | Week of September 14, 2026 |
Drupal 12.0.0-rc1 / 11.5.0-rc1 | Week of November 9, 2026 |
Drupal 12.0.0 / 11.5.0 general release | Week of December 7, 2026 |
Drupal 10 end of life | December 9, 2026 |
Source: Drupal core release schedule — Drupal.org, updated July 2026
Notice 11.5.0 ships the same week as 12.0.0. Drupal always gives the previous major one more minor release alongside the new one, so if you’re on Drupal 11 today, your real target is “get current on 11.5 first,” not “jump to 12 immediately.”
What Do the July 2026 Security Advisories Mean for You?
They’re a preview of what “unsupported” costs once patches stop coming. Two core advisories landed July 15: SA-CORE-2026-010 (information disclosure in the Image module, CVE-2026-15916) and SA-CORE-2026-011 (cross-site scripting via HTMX attribute handling, CVE-2026-15917). Both were patched same-day for supported branches.
What SA-CORE-2026-010 and -011 Actually Covered
The XSS advisory quietly confirms something a lot of teams haven’t clocked: Drupal core has shipped with the HTMX JavaScript library built in since version 11.2, a real shift in how core handles partial page updates. Drupal 10 core wasn’t vulnerable to the XSS issue, but a hardening fix went into 10.6 anyway for contributed modules. The next advisory, filed against a Drupal 10 branch that no longer exists after December 9, won’t get that treatment. A third advisory from the same batch, SA-CORE-2026-012, was also patched July 15; the pattern holds across all three. That’s the actual cost of end of life; it shows up as quiet, unmonitored exposure, not a dramatic outage.
If you migrated off Drupal 7 recently, you’ve seen this movie before; the Drupal 7 to 10/11 migration guide covers what that scramble looks like when it starts too late.
What Breaks When You Move to Drupal 12?
Mostly deprecated code that was already flagged, plus a likely PHP/Symfony floor increase. The pattern repeats every major version:
Risk area | What breaks | Action |
PHP/Symfony floor | Likely increases (unconfirmed) | Confirm hosting has headroom |
Deprecated code | Deleted, not just flagged | Audit custom modules now |
Contributed modules | Lag behind core | Budget real time, not a weekend |
Frontend/JS | HTMX behavior shifted in 11.2 | Test custom JS before upgrading |
Running drupal-check or phpstan-drupal against your custom codebase today, months ahead of the upgrade, is the highest-leverage hour you can spend. It’s the same category of work covered in the Drupal 8 best practices guide, applied to a newer set of deprecations.
Do You Need to Upgrade Straight to Drupal 12?
No, not immediately for most teams. Three realistic paths:
Current version | Recommended path |
Drupal 9 or earlier | Migrate now, don’t wait for 12 |
Drupal 10.x | Update to 10.6, treat December 9, 2026 as a hard stop |
Drupal 11.x | Move to 11.5 first, then 12 on a normal cycle |
The module and custom-code audit is worth treating as its own project phase, separate from the version bump itself. It usually takes longer than the technical upgrade, and it’s the part that gets skipped once a deadline creates pressure. If your CMS decisions were made five years ago by a team that’s moved on, that’s worth revisiting before a deadline forces it, our Drupal partner evaluation guide covers what to ask before committing engineering hours to the work.
Is This Part of a Bigger Shift in Drupal Core?
Yes. AI-assisted authoring, the Canvas page-building experience, and now HTMX-driven interactivity in core all point toward less custom scaffolding and more built-in capability, a different platform than what most enterprise sites were architected against years ago. The Drupal CMS trends for 2026 piece goes deeper into where core is heading.
Pre-Migration Checklist
- Run drupal-check/phpstan-drupal against custom code; catalog every deprecated call.
- Cross-reference contributed modules against current core version support.
- Confirm hosting has PHP headroom for a floor increase.
- Inventory custom JS touching Drupal’s AJAX/form API.
- Stand up a release-candidate staging environment six weeks before cutover, not the week before.
- Decide which clock you’re on: “migrate before December 9” or “we’re on 11, we have room.”
FAQs
What is aHow long does a Drupal 10 to 12 migration take for an enterprise site?n enterprise Drupal development partner, and how is it different from a Drupal agency?
Most enterprise migrations run 8–16 weeks depending on custom module count and contrib dependency health, not including the audit phase. Sites with a clean deprecation audit finish faster; sites that skip it and discover blockers mid-upgrade routinely double that timeline.
Should I upgrade straight to Drupal 12, or go to Drupal 11.5 first?
If you’re on Drupal 10 or 11 today, land on 11.5 first; it ships the same week as 12.0 and gives you a supported, lower-risk step before the major version jump.
What does a Drupal 12 migration typically cost?
Cost scales with custom code volume and contrib module count more than site size. Most of the budget goes to the audit and remediation phase, not the version bump itself.
What happens if we miss the December 9, 2026 deadline?
Nothing breaks immediately, but every subsequent security advisory filed against Drupal 10 goes unpatched. The risk is silent exposure, not downtime.
When is headless Drupal the right architecture decision, and what should I verify about my vendor's capability?
Headless Drupal is the right choice when content needs to reach multiple channels (web, mobile, digital signage, third-party apps) from one managed source, or when frontend performance requirements exceed what a traditional Drupal theme layer can deliver. Verify vendor capability by requesting a live demonstration of a decoupled build in production, specifically the preview architecture, authentication flow, and how content updates propagate to the frontend. Written case studies are not a substitute.
How do we evaluate Drupal project risk when comparing proposals from multiple vendors?
Weigh technical governance signals above price signals. Ask every vendor the same set of technical and contractual questions and score the specificity of their answers. Vendors with genuine operational maturity answer precisely. Vague or generalized responses to questions about SA response times, Composer workflows, CI/CD architecture, and upgrade responsibility are consistent predictors of delivery and maintenance risk.
