Drupal 10 End of Life (December 2026): Your Upgrade Plan

Drupal 10 reaches end of life on December 9, 2026. After that date, the Drupal Security Team will not issue patches for Drupal 10 core or contributed modules. Any vulnerability discovered after that day has no official fix.

If your platform handles regulated data, customer transactions, or anything that goes near a procurement security review, running an unsupported CMS is not a viable position. The good news: this is the most predictable Drupal end-of-life cycle in the project's history, and the upgrade path to Drupal 11 is the cleanest the platform has ever offered. This guide walks through the real dates that affect your site, why Drupal 11 is the target rather than Drupal 12, and a five-step plan a competent Drupal Website Developer can execute before the deadline.

Not every Drupal 10 site reaches end of life on the same day.

Drupal 10.6.x, the final minor release of Drupal 10, is supported until December 9, 2026. After that, no security advisories, no patches, no module updates from the Drupal Security Team. The date is fixed regardless of when Drupal 12 ships.

Sites still running Drupal 10.5.x lose security support on June 17, 2026, nearly six months earlier. If you are on 10.5, you need to update to 10.6 before that date, or move directly to Drupal 11.

Drupal 10.4.x and earlier minor releases stopped receiving security updates on December 10, 2025. Sites still on these versions are already exposed.

A Drupal Development Company on a retainer should have flagged these dates. If yours has not, that itself is a signal worth acting on.

End of life is not a recommendation. It is the moment when the Drupal Security Team stops coordinating patches for that version.

Three things happen on December 9, 2026:

• No core security releases for Drupal 10.
• No contributed module security releases for the Drupal 10 branch.
• Compliance auditors flag Drupal 10 sites as running unsupported software, which usually fails SOC 2, HIPAA, PCI-DSS, and most government procurement reviews.

The site keeps running. It just runs without the safety net.

Drupal 12 releases the week of December 7, 2026, the same week Drupal 10 reaches end of life. That timing is too tight for most production sites.

The practical destination is Drupal 11. Three reasons:

1. Drupal 11 has been stable since August 2024. Contributed modules have had time to catch up. Most actively maintained modules now have a Drupal 11-compatible release.
2. The Drupal 10 to Drupal 11 upgrade is the smallest major-version jump in Drupal's history. Disruptive API removals were deferred to Drupal 13, so the code-level changes between Drupal 10 and Drupal 11 are limited.
3. Drupal 11 to Drupal 12 will be incremental. Once you are on Drupal 11, the move to Drupal 12 looks more like a minor upgrade than a migration.

A Custom Drupal Development Company that recommends jumping straight to Drupal 12 in late 2026 is asking you to be a release-week tester for a brand-new major version. That is a bad place to be for any platform under SLA.

A realistic plan for a mid-market Drupal 10 site, executable over six to twelve weeks.

Run the Upgrade Status module against your production database. It returns a compatibility report for every contrib module and a count of deprecated code calls in custom code. Without this report, every estimate is a guess.

Document your current Drupal version, PHP version, hosting platform, contrib module list with version numbers, and any custom modules or themes.

For each contrib module, one of four outcomes applies:

• Drupal 11 release already exists: update it.
• Drupal 11 patch in progress: subscribe to the issue, plan to apply it.
• No Drupal 11 release planned: find a replacement or sponsor the port.
• Module deprecated and merged into core: remove and use core functionality.

This step usually surfaces two to five modules that block the upgrade. Plan replacements before writing any migration code.

Upgrade Status flags deprecated code in custom modules and themes. A Drupal Website Developer fixes deprecations on the Drupal 10 codebase first, before the version bump. This is critical because deprecation fixes on Drupal 10 are non-breaking, so they can ship to production immediately and reduce the size of the eventual upgrade pull request.

Spin up a staging copy of production. Run composer update to move to Drupal 11. Run database updates with drush updb. Test every editorial workflow, every integration, every front-end template. Performance test under representative load.

Schedule the cutover during a low-traffic window. Take a database snapshot. Deploy. Run database updates. Smoke test. Have a rollback path ready for the first 48 hours.

A Drupal Web Development Company with experience in major-version upgrades will run this entire sequence in four to eight weeks for a typical site, longer for platforms with heavy custom code.

Three issues stall most Drupal 10 to Drupal 11 upgrades.

Abandoned contrib modules. Modules with no active maintainer and no Drupal 11 patch. The fix is to find a maintained alternative, port the module yourself, or sponsor a maintainer through the Drupal Association.

PHP version mismatch. Drupal 11 requires PHP 8.3 or higher. If your hosting platform is still on PHP 8.1 or 8.2, plan the PHP upgrade first.

Custom code that ignores deprecations. Custom modules written by developers unfamiliar with Drupal's deprecation policy often accumulate dozens of warnings. Each one is a small fix, but the total can add a week or more to the timeline.

A regional government portal running Drupal 10.4 contacted a Drupal Development Company in March 2026, three months after their version reached EOL. The site had 14 contrib modules, three custom modules, and a custom theme with 30 deprecated code calls.

The Drupal Development Services team ran Upgrade Status, found two contrib modules with no Drupal 11 release, sponsored a patch for one and replaced the other with a core feature, cleaned up the custom code over three sprints, then ran the upgrade on staging. Total time: nine weeks. Total cost: $48,000. The site went live on Drupal 11 in mid-May 2026, well ahead of the December deadline and ahead of the demand spike most agencies are forecasting for the second half of 2026.

Most Drupal 10 to Drupal 11 upgrades land in one of three bands.

• Light site (a dozen content types, mostly contrib, minimal custom code): four to six weeks, $15,000 to $35,000.
• Mid-market site (custom modules, integrations, multiple editorial roles): eight to twelve weeks, $35,000 to $90,000.
• Enterprise platform (multisite, headless, heavy custom code, multilingual): twelve to twenty weeks, $90,000 to $250,000 and above.

If you wait until the second half of 2026, expect demand to compress the pool of available senior developers. Most agencies forecast a hiring squeeze in Q3 and Q4. Lock your Drupal Website Developer or Hire Drupal Developers from your shortlisted vendor by mid-2026 if you can.

Drupal 10 end of life on December 9, 2026 is the date, not a recommendation. Drupal 11 is the realistic destination, and the upgrade path is the cleanest Drupal has shipped. The risk is timing: the closer you push to the deadline, the smaller the pool of senior Drupal developers and the higher the rates.

Ready to scope your Drupal 10 to Drupal 11 upgrade? Book a 30-minute call with our Drupal practice. You will leave with an Upgrade Status report summary, a written timeline, and a fixed-scope quote for the work.

Plan My Drupal 11 Upgrade