Drupal 12 RC1 Is Due This Week, and Drupal 11.3 Loses Support With Drupal 10

Drupal 12 RC1 is due this week. Drupal.org’s core release schedule lists the week of November 9, 2026 for both 12.0.0-rc1 and 11.5.0-rc1. The final 12.0.0 and 11.5.0 releases are set for the week of December 7.

That same December week, two older branches lose security support: Drupal 10.6 and Drupal 11.3. The Drupal 10 deadline has had most of the attention. The 11.3 deadline has had very little, and it catches sites that moved to Drupal 11 early and then stopped taking minor updates.

The short version: if you run Drupal 11.3, update to 11.4 before December. If you still run Drupal 10, you have until December 9 and should be mid-upgrade now. If you maintain modules or custom code, install Drupal 12 RC1 on a test copy with PHP 8.5 and look for breaks. Release candidates are for testing, not for live sites.

This post covers what the release candidate is, the late core changes planned before it, the 11.3 deadline, and a plan for each version you might be on. It follows our October post on the Drupal 12 beta slip and our June Drupal 12 preview.

What Drupal 12 RC1 is, and what it is not

A release candidate is the build the core team expects to ship unless testing finds a problem. Drupal’s release process overview says "The RC phase lasts for one month" for major versions. The schedule fits that: RC1 the week of November 9, the final release the week of December 7.

Drupal 11.5.0-rc1 ships alongside it. Drupal 11.5 is the minor release that pairs with Drupal 12.0. The same overview says that when a new major ships, "a corresponding minor version with the same API is released for the previous major version." That starts Drupal 11’s long-term support phase.

Neither release candidate belongs on a live site. The 12.0.0-beta2 release notes say "Beta releases are not intended for production." We would treat RC1 the same way. Install it on a copy, test, and report what breaks.

The table shows where each current branch stands, based on drupal.org’s schedule and release notes as of November 2, 2026.

The late core changes planned before Drupal 12 RC1

On October 31, core committer xjm posted on the Drupal core blog about disruptive commits planned ahead of Drupal 12.0.0-rc1. The post names three large changes to land before the release candidates:

• Raising Drupal’s PHPStan rule level to 3 "for improved testing of coding standards and static analysis."
• Converting core classes to PHP 8 constructor property promotion (issue 3278431).
• Removing the @legacy-covers method-level annotations from core tests (issue 3555692).

The post warns core contributors that "New PHPStan failures are also likely on existing merge requests." It also says commits that conflict with these changes "may be reverted" so the large changes can land in order.

After the release candidates, the post says "all disruptive changes (aside from critical dependency updates and similar issues) will begin targeting Drupal 12.1." In plain terms, Drupal 12.0’s code should settle once RC1 is out. That makes RC1 a better test target than the betas.

As of November 2, neither issue had been committed. Both carried a "[November 2026]" tag in their titles, which marks them for this window.

What the changes mean for your modules and custom code

Most of this is core housekeeping. The PHPStan level applies to core’s own checks and to merge requests against core. The @legacy-covers cleanup touches core’s test suite. Neither changes how your module runs.

The constructor change is the one that can reach your code. Comments on issue 3278431 note that constructor argument names would change. They move from snake_case to camelCase to match the property names. Code that passes those arguments by name would then break. Maintainers in the thread said named arguments are not covered by Drupal’s backward compatibility promise. So this break is accepted.

The same thread says subclasses that read the protected properties should be fine. The property names stay the same. So the check for custom code is narrow. Search your custom modules for calls to core constructors that use named arguments. Positional calls, including the usual parent::__construct() pattern, are not affected by the rename.

One more removal is already in the betas. The 12.0.0-beta2 notes say the obsolete Navigation Top Bar module was removed from core, and "Sites with this module enabled should uninstall it prior to updating to 12.0.0-beta2." Check for it before you test RC1.

Drupal 11.3 loses support the same week Drupal 12 ships

The schedule’s December row reads: "Drupal 12.0.0 and 11.5.0 released. End of security support for 11.3.x and 10.6.x." The Drupal 11.3.20 release notes say the same thing in different words: "Drupal 11.3.x will receive security coverage until December 2026."

Drupal 11.3 gets the old 12-month window. Newer minors get less. Under PSA-2026-11-02, each minor now gets six months of bug fixes and two months of security-only fixes. See Drupal’s new eight-month support window for the dates. What makes the 11.3 deadline easy to miss is the timing. It lands in the same week as a major release and the Drupal 10 end of life.

The sites most at risk upgraded from Drupal 10 to 11 in the past year and then stopped. If your composer.json pins drupal/core-recommended to 11.3, routine updates will keep installing 11.3 patch releases. Those stop in December.

The move to 11.4 is a minor update, a much smaller job than a major upgrade. According to drupal.org’s PHP requirements table, 11.3 and 11.4 support the same PHP versions: 8.3, 8.4 and 8.5. So the hosting side does not need to change. The 11.4.11 release notes still say June 2027. Drupal’s schedule now lists April 21, 2027 as the last day of security support for 11.4.x.

A plan for each Drupal version you might be on

On Drupal 10.x. Move to Drupal 11.4 now. You cannot jump from 10 to 12. The Upgrade Status project page says it is "not possible to directly upgrade from Drupal 9 to Drupal 11/12 or Drupal 10 to 12." Our Upgrade Status walkthrough and Drupal 10 to 11 guide cover the steps. If you need sign-off, our one-page board brief is written for that.

On Drupal 11.3. Update to 11.4 before the week of December 7. Run database updates, clear caches, and test the paths your staff use most. Then change your Composer constraint so future updates do not stall on one minor again.

On Drupal 11.4. You have security coverage until April 21, 2027. There is no rush to move to 12.0 in December. Use the Drupal 12 RC1 period to find out what the move would cost you.

Maintaining contrib or custom modules. Test against Drupal 12 RC1 now. Bugs found in Drupal 12 RC1 can still be fixed before 12.0.0. After that, fixes follow the normal patch schedule.

How to test your site against Drupal 12 RC1

Start with Upgrade Status on a Drupal 11 copy of the site. The project page says 5.0.0-alpha3 works with "^10.4 || ^11 || ^12" and lists "Improved Drupal 11.4 and 12.0 compatibility." The page also says you run the checks on your current site against the next major, so the scan happens on Drupal 11.

Next, set up a separate copy on PHP 8.5. Drupal.org’s PHP table marks 8.3 and 8.4 as not supported for Drupal 12.0. The same page says "From Drupal 12.0, PHP should be compiled with the argon2 support for password hashing." Ask your host whether its PHP 8.5 build includes argon2 before you book test time.

Then update the copy to Drupal 12 RC1 and run database updates. Test logins first, since that argon2 note is about password hashing. After that, check forms, editor workflows, Views, custom blocks and any module that extends core classes.

Report core bugs in the Drupal core issue queue with clear steps. For contrib bugs, use that module’s queue. Our post on the October 14 core security release is a reminder that test builds get security fixes too. Beta2 carried that release’s fixes, so keep test copies current.

What could still change before December

The beta schedule already moved once. The schedule listed 12.0.0-beta1 for the week of September 14. The 12.0.0-beta1 release notes are dated September 30. As of November 2, the Drupal 12 RC1 and final dates had not moved.

If testing finds serious problems, the final release date could move. The 11.3 and 10.6 support end dates are tied to that December row. The Drupal 10 end-of-life date of December 9 did not move when the beta slipped.

Security releases can also come outside the monthly windows. The schedule page says "a security release may be published outside of the pre-set release windows." Keep an eye on drupal.org’s security advisories through December, whichever branch you run.

Frequently Asked Questions