Drupal 10 End-of-Life December 2026: A Migration Decision Framework

Drupal 10 reaches its scheduled end-of-life in December 2026 — roughly seven months from now. Unlike the Drupal 7 sunset, this isn't a 14-year-old platform with abandoned modules and structural debt. It's the version most teams just finished migrating to. But the deadline is real, and the choice you make in the next quarter is what determines whether your 2027 starts with a calm patch cycle or another emergency project.

This is a decision framework, not a panic post. Drupal 10 → Drupal 11 is the easiest major upgrade Drupal has ever shipped. The real question is when you do it and which dependencies you handle first.

If you're still on Drupal 7, this is the wrong post for you — see Drupal 7 End-of-Life: What It Means for Your Website Security instead.

The deadline that's actually coming

Drupal 10 was released June 14, 2023, and the Drupal Association has communicated December 2026 as its end-of-life — aligned with the Drupal 12 release timeline. After that date, three things change:

No more core security advisories for the Drupal 10 branch.
Contributed modules — the actively maintained ones — drop their D10 branches and ship D11 only.
Compliance posture shifts: every framework that flagged Drupal 7 sites on EOL day starts flagging D10 sites on the same basis.

The mechanism is the same as Drupal 7's January 2025 sunset, just on a much shorter runway. The difference is the destination — Drupal 11 — is a near-painless upgrade for most well-maintained D10 sites. The risk profile of staying past EOL is the same as any unsupported software; what's different is how cheap the fix is.

Why Drupal 10 → 11 is not a Drupal 7 → 11 migration

Treat these as two completely different problems.

Drupal 7 → Drupal 11 is a replatform. Symfony, Twig, configuration management, the entire module ecosystem, the theme layer — all rebuilt from Drupal 8 onward. For a typical D7 site, expect 8–16 weeks of focused work. We covered the scope, the failure modes, and the five signals that say it's overdue elsewhere.

Drupal 10 → Drupal 11 is an upgrade, not a migration. Composer pulls new versions, Drupal Rector rewrites deprecated APIs in your custom code automatically, the database update runs, and the site keeps running. For a healthy D10 site with maintained contrib modules, the work is days to a few weeks of focused engineering — not months.

What makes that possible is the discipline Drupal 11 enforced before release. Every deprecation in D10 shipped with a Rector rule. The Upgrade Status module reports cleanly against your codebase. Contrib maintainers that wanted to stay in the ecosystem tested against D11 throughout 2024.

That doesn't mean the upgrade is free. It means the cost is predictable.

What actually breaks in the upgrade

Three things consistently catch teams off guard.

Hosting requirements. Drupal 11 needs PHP 8.3, MySQL 8.0+, MariaDB 10.6+, or PostgreSQL 16+. If your hosting plan or dedicated server is locked to PHP 8.1, that's the first invoice — sometimes the only one — in the upgrade budget. Audit this before scoping anything else.

Removed and relocated core modules. Drupal 11 removed several modules from core entirely (Statistics, Aggregator, HAL, Quick Edit among others) and moved others — Book, Forum, Tour, RDF, Workspaces — to contrib. If your site uses any of these, you either install the contrib equivalent (cheap) or replace the functionality (less cheap). CKEditor 4 was already removed in Drupal 10; if you skipped that migration, it lands here.

Contrib module gaps. Most popular contrib modules ship D11-compatible versions, but the long tail doesn't. A site with 30 contrib modules typically finds 1–3 that need replacement, a fork, or a custom port. Every additional contributed module is one more compatibility check.

Custom code rarely breaks when Rector is run early and the team fixes the warnings as they appear. Custom code breaks when teams skip Rector and discover three years of deprecated API calls during the actual upgrade week.

Your three real options

Option 1: Upgrade now (recommended for most)

Start the work in Q2 or Q3 2026 and finish before the EOL window closes. You get a calm timeline, a normal QA cycle, and a maintained platform on January 1, 2027. For a typical content site with maintained modules, plan 2–6 weeks of engineering plus QA — most of which is automatable.

Do this if:

Your site is on Drupal 10.2+ with reasonably current contrib
Your hosting can move to PHP 8.3 and MySQL 8 without an infrastructure project
You have engineering bandwidth in Q2 or Q3 2026

Option 2: Plan for late 2026, accept a brief unsupported window

Push the upgrade to late Q4 2026 or early 2027 if you have a freeze, a release in flight, or budget aligned to next year's quarter. The exposure window is short but real — you'll spend a few weeks running unsupported.

Mitigations:

Verify cyber insurance language doesn't void coverage during the gap
Tighten WAF rules and intrusion monitoring during the window
Have a tested rollback path before you ship the upgrade

This is workable for low-risk content sites. It is not workable for sites under PCI DSS, HIPAA, or SOC 2 audit cycles overlapping the gap.

Option 3: Stay on Drupal 10 indefinitely

There is no Extended Security Support program announced for Drupal 10 of the kind that exists for Drupal 7. Staying on D10 past EOL means accepting the same risk profile that's driven the D7 migrations of the last 18 months — without the cost savings, because the upgrade target (D11) is cheap.

This option exists. It is almost never the right call.

A 30-minute Drupal 10 readiness check

Before talking to anyone, get answers to these from your own codebase:

What Drupal 10 minor version are you on? Anything below 10.2 means a minor upgrade first. drush status shows it in one line.
What's your PHP version? Run php -v. If it's not 8.3+, your hosting upgrade is the first ticket.
What does Upgrade Status report? Install the module, run the report, and read the "needs review" list. Open issues per affected module and time-box each.
What's your contrib module count, and how many have D11 stable releases? Cross-reference each module page on drupal.org. Anything without a D11 release in the next quarter is a flag.
How much custom code do you have? find . -path "*/modules/custom/*" -name "*.php" | xargs wc -l. Run Drupal Rector against it; the warning count is your custom-code budget.
What's your test coverage? If you don't have at least smoke tests for your content types and your most-trafficked pages, an upgrade week is when you'll wish you did.
What's your audit calendar in 2027? PCI, SOC 2, and vendor security reviews scheduled in Q1 2027 set your real deadline, not December 2026.

Three or more of those landing as "I don't know" means start the readiness work this month, not the upgrade.

Why the cost rises after September

Drupal 10 → 11 is cheap because the ecosystem moves with you. That stops being true the further past EOL you go.

Contrib drops faster than you think. Modules that release a "final D10 version" in November typically stop accepting D10 issue reports in January. Bug reports go unfixed.
Engineering availability tightens. Every team waits until October or November. Agencies and freelance engineers are booked solid in Q4 2026 — and they raise rates because they can.
Compliance gaps compound. Every audit cycle that lands while you're unsupported is a finding. Findings carry into the next cycle.
Hosting providers rotate. Several mid-tier Drupal hosts will sunset their D10 stack within a quarter of EOL. Forced moves under pressure are how routine upgrades turn into emergencies.

A planned upgrade in July 2026 costs a fraction of an emergency upgrade in March 2027.

Frequently asked questions

Is Drupal 10 EOL really December 2026?

Yes. The Drupal Association has communicated December 2026 as the end-of-support date for Drupal 10, aligned with the Drupal 12 release timeline. The exact day inside December may shift, but the calendar quarter is fixed.

How long does a Drupal 10 to Drupal 11 upgrade take?

For a healthy D10 site (current minor version, mostly maintained contrib, modest custom code), 2–6 weeks of focused engineering plus QA. Drupal Rector handles most deprecation rewrites automatically.

Will my Drupal 10 contrib modules work in Drupal 11?

Most popular ones ship D11 versions. A typical 30-module site finds 1–3 that need replacement, a fork, or a custom port. The Upgrade Status module gives you the per-module list in minutes.

Do I need to upgrade to Drupal 10.4 first before Drupal 11?

Yes. The supported upgrade path is from the latest Drupal 10 minor release. Sites still on 10.0 or 10.1 should land on the current 10.x first, then upgrade to 11. Both steps together are normally still under six weeks for a healthy site.

Is there Extended Security Support for Drupal 10?

No equivalent program to Drupal 7's commercial ESS has been announced for Drupal 10. The expectation is that organizations upgrade to Drupal 11 within the EOL window.

Should I skip Drupal 11 and wait for Drupal 12?

No. Drupal 12 is on a 2027 timeline, and skipping a major release multiplies upgrade risk. The cheapest path is the supported one — ride the major-version cadence.

What if I'm still on Drupal 7?

The D10 EOL is not your problem yet. See Drupal 7 End-of-Life: What It Means for Your Website Security and 5 Signs Your Drupal Site Is a Security Risk. Your jump is to Drupal 11 directly, and the timeline is months, not weeks.

Plan the upgrade before it plans you

The Drupal 10 → 11 upgrade is the easiest major Drupal has shipped. That's exactly why it's worth scoping properly: a small, predictable project run on your terms beats a small, predictable project run under audit pressure every time.

We help teams scope the upgrade — readiness audit, hosting plan, module triage, timeline, and risk register — in a single 30-minute call.

Schedule a free Drupal 11 upgrade consultation →