To verify Drupal development claims in 2026, match the claimed version against Drupal.org release notes and search the change records. A claim holds when it names a supported branch, the patched version, and the replacement for any deprecated feature. Drupal is an open-source content management system used for marketing sites, membership sites, and complex integrations. Release notes confirm security coverage, while change records document removals and testing changes that affect proposals.
Table of Contents
- Is the claimed version still supported?
- Does the security fix check out?
- What about search and testing promises?
- Which red flags reject a claim fast?
Is the claimed version still supported?
Only 11.4.x, 11.3.x, and 10.6.x receive security coverage. According to Drupal.org in security advisory SA-CORE-2026-014, Drupal 11.2.x and below plus 10.5.x and below are end-of-life with no fixes, and Drupal 8 and 9 are also end-of-life. Coverage also expires on fixed dates. According to Drupal.org in the Drupal 10.6.19 release notes, 10.6.x ends in Dec.
2026, 11.3.x ends in Dec. 2026 with 11.5.0, and 11.4.x ends in June 2027 with 11.6.0. Ask any vendor using the phrase fully supported to name the exact branch. If the site runs 11.2.x, 10.5.x, 8, or 9, budget for an upgrade before buying new features.
Does the security fix check out?
Drupal core 11.4.10 is a security release that urges immediate updating. According to Drupal.org, it addresses critical remote code execution SA-CORE-2026-014 plus XSS issues SA-CORE-2026-015 and SA-CORE-2026-016. The prescribed remediations are exact: 11.4.x to 11.4.10, 11.3.x to 11.3.19, and 10.6.x to 10.6.19.
According to the same Drupal.org advisory, teams that cannot patch must uninstall core Field UI as mitigation. An advance notice scheduled the October 2026 core security release for Oct. 14, 2026, 16:00-21:00 UTC across 11.4.x, 11.3.x, 10.6.x, and 12.0.0-beta1. Use that pattern to judge vendors: a valid claim lists the advisory ID, affected range, and patched version.
What about search and testing promises?
Core Search was deprecated in 11.5.0 and will be removed in 12.0.0. According to Drupal.org in the change record on core Search deprecation, 2026 proposals relying on core Search must document the replacement recommendation. Testing claims need the same scrutiny. According to Drupal.org, core release packages from 12.0.0 exclude tests, so vendors claiming tests against a tagged release must show install with composer –prefer-source.
Drupal 12 is due in early Dec. 2026. For a WordPress comparison, this is like claiming support for a retired search plugin. Ask for the replacement module, migration effort, and test method in writing.
Which red flags reject a claim fast?
Demand the advisory ID, affected range, patched version, EOL status, and usage statistics. According to the 2025 Pantheon guide in the Pantheon guide to evaluating contrib modules, stable releases receive Security Team coverage while beta and alpha releases do not.
Watch for these warning signs: Reject any proposal with two or more flags. Ask for corrected versions, dates, and usage data before approving scope.
- no advisory ID or patched version for a security claim
- fully supported without naming 11.4.x, 11.3.x, or 10.6.x
- core Search proposed for 11.5.0 or later without a replacement
- beta module presented as security-covered
