Drupal / Enterprise CMS
November 2, 20267 min read
Drupal 10 Ends December 9. Drupal 12 Launches the Same Week.
Drupal 10's end of security support and Drupal 12's launch land in the same December 2026 week. For an enterprise running Drupal, the planning window has already closed — what's left is executing the move well.

Two dates, one week, zero slack
Drupal's official calendar no longer leaves room for ambiguity. Drupal 10 reaches end of life on December 9, 2026 — the same week Drupal 12.0.0 and 11.5.0 launch. That's not a coincidence: the community locked in that EOL date more than a year ago specifically to align with the new major release, and confirmed it as a fixed commitment regardless of exactly when Drupal 12 shipped.
Dec 9, 2026
End of Drupal 10 security support
Week of Dec 7
Drupal 12.0 and 11.5.0 launch
11.3+
Minimum version required before jumping to Drupal 12
For an enterprise, this isn't a technical press release. It's an operational-risk deadline: starting in December, any site still on Drupal 10 stops receiving security patches. If your organization already lived through October's critical patch advisory, you know how fast an unfixed vulnerability becomes a conversation with legal and compliance.
What disappears in Drupal 12
Drupal 12 isn't a cosmetic refresh. By design it's Drupal 11 with all deprecated code removed — which means several pieces your site likely uses today simply stop existing in core.
| Item | What happens in Drupal 12 |
|---|---|
| Claro and Olivero themes | Removed from core |
| Search module | Removed from core |
| Toolbar module | Removed from core |
| Ban, Contact, Field Layout, History, Migrate Drupal, Migrate Drupal UI | Moved to contributed projects — must be required separately before upgrading |
| HTMX | Jumps from v2 to v4 |
Several modules are deprecated in Drupal 11 and removed in Drupal 12: Ban, Contact, Field Layout, History, Migrate Drupal, Migrate Drupal UI. Sites should check their installed modules against the following list, and either uninstall the extension or require the contributed version prior to upgrading to Drupal 12. Core also confirmed in its September 2026 change log that The Claro theme is removed... the Olivero theme is removed... The Search module is removed... The Toolbar module removed.
bash
composer require 'drupal/core-dev:^12' --dev --no-update
composer require 'drush/drush:^13' --no-updateThe path can't be shortcut
Here's the detail that matters most for budgeting and scheduling: there is no direct route from Drupal 10 to Drupal 12. Drupal never allows skipping a major version during an upgrade: A major version cannot be skipped during an upgrade. For example, to upgrade from Drupal 9 to Drupal 11, a site must upgrade from Drupal 9 to Drupal 10, and then to Drupal 11. And Drupal 12 removes database upgrade paths predating 11.3: all the configuration, database schema, entity/field, etc. upgrades up to Drupal 11.2.0 are removed in Drupal 12. That means that Drupal 10 sites must upgrade to 11.3.0 or higher to get those updates, before upgrading to Drupal 12.
In practice: an enterprise site on Drupal 10.3 can't "jump" straight to Drupal 12 in one effort. It first moves to a recent 11.x release, verifies every contributed module, and only then makes the second jump. That's two migration projects, not one — though they can be planned and executed as a single coordinated initiative.
Important
If your site is still on Drupal 9 or an early Drupal 10 release, the path isn't two jumps — it's three. Every major version left to cover multiplies the time spent auditing custom modules before reaching a version with active support.
History already taught this lesson
This pattern isn't new. When Drupal 9 reached end of life on November 1, 2023, the underlying reason was the same one driving this cycle: Drupal 9 relies on several other software projects, including Symfony, CKEditor, and Twig. With Symfony 4's end of life, CKEditor 4's end of life, and Twig 2's end of life all coming up soon, Drupal 9 went end of life on November 1st, 2023. Months ahead of that deadline, tens of thousands of sites still hadn't migrated — a pattern the community has watched repeat at every major transition.
For stragglers, a safety net exists: a community Long Term Support (LTS) project that facilitates long term support of Drupal versions through patches. Its goal is to both help support older versions of Drupal and generate interest in official long term support. It's a real option — but it isn't free, isn't indefinite, and doesn't substitute for running a version with official core support.
What this means for your business
A major-version migration in Drupal isn't an IT line item that can be deferred indefinitely without consequence. It's, in essence, a decision about how much unpatched security exposure the organization is willing to carry after December, and how much engineering time is needed to avoid it without disrupting the revenue-generating site running today.
- Real version inventory: confirm the exact Drupal 10 or 11 minor release each digital property runs, don't assume it
- Contributed module audit: which ones have a Drupal 12 compatibility path and which are orphaned
- Custom code exposure: how much depends on themes (
Claro,Olivero) or modules (Search,Toolbar) that core removes - Execution window: schedule the 10 → 11 → 12 jump before post-EOL security pressure forces a rushed migration
Teams that have already run Drupal migrations under calendar pressure — like on Multimedios's media platform, built on Drupal and AWS — know the real risk isn't the core upgrade itself, but the custom code and contributed modules nobody audited in time. Getting this right is a matter of continuous governance, not a last-minute sprint: someone with real Drupal expertise watching the version inventory year-round, not only when the deadline arrives.
Need help with this?
This is exactly what we do in Build (Development). Our team can implement it in your company.
Related Articles
Keep learning with these articles

Drupal / Enterprise CMS
Drupal Confirms a Critical Patch for October 14. Here's How the Real Risk Is Measured.
On October 14 Drupal ships a critical core patch affecting every supported branch. The window is five hours. What you do before and after that window says more about your operation than the patch itself.
7 min readRead this →

Drupal / Enterprise CMS
Drupal CMS 2.0: AI Isn't the Risk Anymore. Ungoverned AI Is.
Drupal CMS 2.0 shipped a visual editor and real performance gains. What actually matters for an enterprise sits underneath: an AI governance layer that logs every agent action before it touches production.
7 min readRead this →
Want to implement this in your company?
We can help you take your business to the next level with cutting-edge technology.