Drupal 10 End of Life: Date, Timeline & Upgrade Plan

Drupal 10 End of Life: Date, Timeline, and Upgrade Planning

Drupal 10 reaches end of life on December 9, 2026. After that date, it no longer receives security advisories, bug fixes, or official support.

If you are reading this in late 2026, that deadline is weeks away rather than months. This guide covers the Drupal 10 EOL date, the full support timeline, what unsupported software actually exposes you to, and the upgrade steps site owners should be working through now.

When Does Drupal 10 Reach End of Life?

Drupal 10 end-of-life date

Drupal 10's end-of-life date is December 9, 2026. That applies to the entire Drupal 10 series, not an individual minor release. Whether you run 10.2 or the final 10.6.x line, security coverage for all of it stops on the same day.

What "end of life" actually means

EOL is a support boundary, not a shutdown. Your site will keep running on December 10. What disappears is the safety net:

• No security advisories or patches for newly discovered vulnerabilities in Drupal core
• No bug fixes or compatibility updates
• Declining third-party support, as contributed module maintainers drop Drupal 10 compatibility and focus on Drupal 11 and 12
• No official help from the Drupal Security Team if a critical issue emerges

In practice, the risk compounds. A vulnerability disclosed in January 2027 that affects Drupal 10 will simply never be fixed in Drupal 10.

Drupal 10 Support Timeline

Drupal 10 security support

Drupal 10 was released in December 2022 and has received roughly four years of active development and security coverage. Under Drupal's support policy, only the most recent minor version of a major release receives full security support. Each time a new minor release arrives, the previous minor line moves to limited coverage, then drops off.

The practical implication for site owners: staying on an older minor release such as 10.3 already means weaker coverage than the current line, even before the December 2026 cutoff. Running the newest minor version is the baseline requirement for a supported site.

Minor releases and the final Drupal 10 line

The 10.6.x series is the final minor release line in the Drupal 10 branch, arriving in mid-2026. No further feature work lands in Drupal 10 after it; the remaining releases are security and critical bug fixes only, until support ends on December 9.

Drupal version end-of-life history

Drupal's recent EOL dates show a consistent cadence and are useful for planning:

• Drupal 7 reached end of life in January 2025, after an unusually long, repeatedly extended lifespan
• Drupal 8 reached end of life on November 2, 2021
• Drupal 9 reached end of life on November 1, 2023
• Drupal 10 reaches end of life on December 9, 2026
• Drupal 11, released in August 2024, is the current version with support continuing well beyond Drupal 10's cutoff

Why Drupal 10 Support Is Ending

Modern Drupal follows a predictable release cycle: a new major version roughly every two years, with minor releases about every six months. That rhythm is driven partly by Drupal's underlying dependencies, particularly the Symfony framework and PHP. Each major Drupal version is built on a specific Symfony major release, and when Symfony's own support window closes, Drupal cannot responsibly keep shipping security fixes on top of it.

This is the same dynamic that ended Drupal 9: its Symfony dependency reached end of support, which set the outer bound on Drupal 9's own lifespan. In the same way, Drupal 11 uses the 7.x branch of Symfony, so the Drupal 11 EOL will be no later than the already announced ROL for Symfony 7.4 of Nov 30, 2029, but likely sooner.

The upside of this discipline, which Drupal core release managers including Gábor Hojtsy have documented extensively, is predictability. Unlike the Drupal 7 era of shifting deadlines, you can plan multi-year budgets and roadmaps against a known schedule. There is no long-term support (LTS) tier that extends Drupal 10 past December 2026.

What Happens If You Stay on Drupal 10 After EOL

Some organizations will miss the deadline. It is worth being clear about what that means.

Security exposure. Unpatched vulnerabilities in a public-facing CMS are among the most reliably exploited attack surfaces on the web. Drupal's security record is strong precisely because the Security Team patches quickly, and that protection ends at EOL.

Compliance risk. Running known-vulnerable software complicates GDPR, HIPAA, PCI DSS, and SOC 2 obligations. Frameworks generally expect reasonable technical safeguards, and an unsupported codebase is difficult to defend in an audit or after a breach.

Module and dependency decay. Contributed modules move on. Over time you will hit versions, PHP releases, and third-party integrations that no longer support Drupal 10, and the upgrade you deferred gets harder and more expensive.

Rising cost. Deferred upgrades do not get cheaper. Skipping a version means more deprecated code to remediate, more module incompatibilities to resolve, and a larger project when you eventually move.

Prepare for Drupal 10 EOL: Your Upgrade Path

The good news: since Drupal 8, upgrades between major versions require far less rework than they once did. Moving from Drupal 10 to Drupal 11 is not a rebuild or a migration in the Drupal 7 sense. It is an update, provided you have kept current.

Drupal 10 to 11 upgrade steps

1. Update to the latest Drupal 10 minor release. Drupal 11 compatibility work depends on deprecation notices introduced in late 10.x releases. Sites on 10.2 or earlier must move up first.
2. Meet the platform requirements. Drupal 11 requires PHP 8.3 or higher and updated database versions (MySQL 8.0, MariaDB 10.6, or PostgreSQL 16). Confirm your hosting environment before you start.
3. Run a deprecation scan. Install the Upgrade Status module to inventory deprecated API use in your custom code and flag contributed modules lacking a Drupal 11-compatible release.
4. Remediate deprecated code. Drupal Rector resolves many deprecations automatically, and AI-assisted development tooling has shortened the remaining manual fixes considerably compared with previous upgrade cycles.
5. Update contributed modules. Bring every contrib project to a Drupal 11-compatible version. Unmaintained modules are the most common blocker, so identify replacements early. Remember to run database updates as you move modules to newer version.
6. Test, then update core. Run composer update as a dry run first, resolve any dependency conflicts, and deploy through a staging environment before production.

What if a module doesn't have a release compatible with Drupal 11?

By now, if a contributed module doesn't yet have a version that works with Drupal 11, It's reasonable to assume a compatible release won't be coming from the community any time soon. The good news is that you still have options:

• Have someone on your team (or your development partner's team) apply to become a maintainer of the module, then create a compatible release. Be warned, however: this process often takes at least three weeks, in addition to the work of actually creating the release
• Find an alternative module. It's possible the community has moved on to a similar module that accomplishes the same thing. Some research may be required
• Find an alternative approach to solve the same problem. Modern tools like ECA allow Drupal sites to solve common feature requests (such as redirecting users to specific site areas on login, based on role) without dedicated modules
• Solve the problem with custom code. This is obviously the most flexible solution, but will likely have the highest total cost of ownership over the long term

Should you skip Drupal 11 and wait for Drupal 12?

Some teams ask whether to skip a version. Generally, no. Drupal 12 is expected in late 2026, but there is no supported path that jumps from Drupal 10 straight past Drupal 11, and waiting leaves you unsupported in the interim.

The better strategy is to get to Drupal 11 now. Once you are on a current major version with no deprecated code, the eventual move to Drupal 12 becomes a routine update rather than a project. Staying current is the whole point of the modern release cycle.

Drupal 10 End-of-Life Planning by Timeline

Where you should be, depending on how much runway you have:

• More than six months out: Run Upgrade Status, scope custom code remediation, and identify unmaintained contributed modules. Budget the work.
• Three to six months out: Complete module updates and custom code fixes. Upgrade development and staging environments. Begin testing.
• Under three months out: Prioritize the production upgrade. If the full upgrade cannot land before December 9, engage a Drupal partner and put compensating controls in place, such as a web application firewall and heightened monitoring, to reduce exposure in the gap.
• Already past EOL: Treat the upgrade as a security incident waiting to happen and escalate accordingly.

Plan Your Upgrade With Acquia

Acquia is the world's foremost contributor to Drupal, and our teams have moved organizations through every major version transition since Drupal 7. Whether you need help scoping deprecation work, updating contributed modules, or executing the upgrade on a deadline, we can help you reach a supported version before Drupal 10 support ends.

For support timelines across Acquia products and supporting software, see Acquia's end-of-life schedule.