GitLab Password Reset
Investigating - GovCMS GitLab users will be required to reset their password.
The wording you will see in the email is system generated. Please be assured this was GovCMS that triggered it. All Gitlab passwords need to be updated.

GitLab PATs (Personal Access Tokens) have been disabled. We will let you know shortly when they will be reenabled.
Nov 11, 2026 - 10:12 AEDT
Notice of upcoming GovCMS lagoon update 11.4.0.1
Update - Bulk deployments to non-production environments will resume this evening and run throughout the night.
Nov 10, 2026 - 16:36 AEDT
Update - Bulk deployments to non-production environments has been paused.
Nov 04, 2026 - 10:52 AEDT
Update - Deployments of Lagoon 11.4.0.1 are complete for production sites and are now commencing on non-prod sites.
The deployment block has been lifted.
Nov 03, 2026 - 11:13 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Nov 03, 2026 - 06:00 AEDT
Scheduled - Advice
We would like to inform you the upcoming GovCMS Drupal 11 (D11) lagoon release and deployment. This is a lagoon only deployment. There is no need for a SaaS deployment block, nor will there be any post deployment actions eg configuration export. PaaS deployments schedules are not impacted.

SaaS deployment schedule:
- Deployment to commence from 6:00am AEDT Tuesday 3 November 2026 and will be conducted throughout the daytime.
- Production branches completed by 10:00am AEDT Wednesday 4 November 2026
- Non-Production branches completed by 10:00am AEDT Thursday 5 November 2026

PaaS Actions
Please ensure you address https://www.drupal.org/sa-contrib-2026-286 if required. The SLA for this one is Thursday 5 November 2026.
- If you are using the default scaffold and have scaffold-tooling in composer.json, then run composer update govcms/scaffold-tooling
- If you include stage_file_proxy in composer.json yourself then run composer update drupal/stage_file_proxy
- If you don't use stage file proxy, then don't worry no action required

If you have any concerns, raise a ticket at https://www.govcms.support
Nov 3, 2026 06:00 - Nov 7, 2026 10:00 AEDT

About This Site

GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io

Uptime over the past 90 days. View historical uptime.
GovCMS Hosting and Infrastructure Operational
Hosting Infrastructure (Amazon EKS) Operational
Akamai CDN cache Operational
AWS Compute (Sydney) Operational
AWS S3 Storage (Sydney) Operational
AWS LoadBalancer (Sydney) Operational
GovCMS E-mail relay (AWS Simple Email Service) Operational
HTTPS Redirect Service Operational
GovCMS Projects Under Maintenance
Individual websites Under Maintenance
GovCMS Sites Dashboard Operational
GovCMS Sites Logging System (OpenSearch) Operational
GovCMS GitLab Operational
Deployment Infrastructure Operational
Lagoon API Operational
Akamai API Operational
Lagoon tasks Operational
GovCMS Service Desk (Freshdesk) Operational
Freshdesk email notifications Operational
Freshdesk search Operational
Freshdesk incoming emails Operational
Freshdesk outgoing emails Operational
Other Operational
Pygmy Operational
Docker Desktop Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.

No incidents or maintenance related to this downtime.

Scheduled Maintenance

Notice of upcoming GovCMS D11 hotfix release 4.6.1 Nov 11, 2026 18:00 - Nov 15, 2026 22:00 AEDT

Advice
We would like to inform you of the upcoming GovCMS Drupal 11 (D11) release and deployment. It addresses a recent security advisory issued by Drupal.org. GovCMS assessed the CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained CRITICAL. The D11 distribution will continue to be supported after this update.

Given the limited GitLab and deployment availability over the past week, this deployment will be scheduled after hours to reduce impact of the deployment block during business hours.

As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. PaaS deployments schedules are not impacted by the SaaS deployment block.

Module Updates:
Update drupal/simple_oauth module from 6.1.3 to 6.1.4
- https://www.drupal.org/project/simple_oauth/releases/6.1.4
- https://www.drupal.org/sa-contrib-2026-296

Deployment schedule:
- Deployment to commence from 6PM AEDT Wednesday 11 November 2026 and will be conducted throughout the evening.
- Production branches completed by 11AM AEDT Thursday 12 November 2026
- Non-Production branches completed by 10AM AEDT Friday 13 November 2026

PaaS Actions:
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (9 November 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.6.1
- GovCMS lagoon (9 November 2026) > https://github.com/govCMS/lagoon/releases/tag/11.4.0.2
- GovCMS scaffold (15 September 2026) > https://github.com/govCMS/scaffold/releases/tag/4.1.0
- GovCMS scaffold-tooling (29 October 2026) > https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.12
Posted on Nov 10, 2026 - 17:49 AEDT

Regular Weekly Maintenance - GovCMS Nov 17, 2026 23:00 - Nov 18, 2026 06:00 AEDT

We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Nov 10, 2026 - 07:00 AEDT

Nov 11, 2026

Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Nov 11, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Nov 10, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Nov 3, 07:00 AEDT

Nov 10, 2026

Investigating issue that may be affecting deployments
Resolved - GovCMS is back up and running.

SSH is now available and deployments are unblocked and working again. This also means that the GovCMS Service Desk will be able to resume addressing the ticket backlog.

That’s a wrap for this issue - Thank you everyone for your patience during this time.
Nov 10, 16:41 AEDT
Update - GovCMS Lagoon Dashboard, including the Lagoon API has been restored. As part of restoring access all existing GitLab Personal Access Tokens (PATs) have been revoked and you’ll need to set up new ones.

SSH remains unavailable so deployments are still blocked.

The GovCMS Service Desk will do its best efforts to address tickets raised as soon as they can, noting they are still working within the limitations.
Nov 10, 10:03 AEDT
Update - We appreciate your continued patience while we thoroughly work through this.

Access to GovCMS GitLab has been restored.

We are currently working through our staged restoration plan for platform availability. At present access to Lagoon Dashboard and deployments are still blocked.

The GovCMS Service Desk will do its best efforts to address tickets raised as soon as they can, noting they are still working within the limitations.
Nov 9, 16:48 AEDT
Update - Thank you for your patience while we continue our investigation. During this time, access to GovCMS GitLab and Lagoon Dashboard remains unavailable.

The GovCMS Service Desk will do its best efforts to address tickets raised as soon as they can, noting they also have the above limitations.

We are currently working through a plan to restore platform availability, but unfortunately at this stage are unable to provide a defined timeline.
Nov 9, 14:01 AEDT
Update - Access to GovCMS GitLab and Lagoon Dashboard has been disabled.
We’re continuing to investigate the activity as a priority. Further updates will be provided as the investigation progresses.
Nov 6, 20:44 AEDT
Update - In addition to our last message, GitLab PATs (Personal Access Tokens) have been disabled.
We'll provide more information about token regeneration soon.
Nov 5, 12:49 AEDT
Update - Due to a variety of issues deployments via GitLab may fail. If you have an urgent release, please raise a critical Service Desk ticket. Service Desk will do all best efforts to help, noting the SSH message below.

Advanced Lagoon tasks are now temporarily disabled.

SSH is still unavailable.
- We’re working on it and anticipate around mid-afternoon it we’ll have it up and running again.
- The GovCMS Service Desk also uses SSH functionality to complete some tasks. These are currently unable to be completed until the SSH component is fully restored.

Projects with OAuth enabled, may still be experiencing deployment issues.

GovCMS continues to investigate the activity as a priority and is closely monitoring the platform. Further updates will be provided as the investigation progresses.
Nov 5, 11:55 AEDT
Update - Advanced Lagoon tasks are now temporarily disabled.

SSH is still unavailable.
- We’re working on it and anticipate around mid afternoon it will be available for PaaS customers.
- SaaS customers are not impacted.
- The GovCMS Service Desk also uses SSH functionality to complete some tasks. These are currently unable to be completed until the SSH component is fully restored

Projects with OAuth enabled, may still be experiencing deployment issues.

GovCMS continues to investigate the activity as a priority and is closely monitoring the platform. Further updates will be provided as the investigation progresses.
Nov 5, 11:00 AEDT
Update - SSH is still unavailable.
- We’re working on it and anticipate around mid afternoon it will be available for PaaS customers.
- SaaS customers are not impacted.
- The GovCMS Service Desk also uses SSH functionality to complete some tasks. These are currently unable to be completed until the SSH component is fully restored

Projects with OAuth enabled, may still be experiencing deployment issues.

GovCMS continues to investigate the activity as a priority and is closely monitoring the platform. Further updates will be provided as the investigation progresses.
Nov 5, 10:22 AEDT
Update - GitLab and project dashboards are now available.

SSH is still unavailable.
- PaaS customers will not be able to SSH into your projects.
- SaaS customers are not impacted.

GovCMS continues to investigate the activity as a priority and is closely monitoring the platform. Further updates will be provided as the investigation progresses.
Nov 4, 15:38 AEDT
Update - GovCMS has identified unusual behaviour on the platform and is taking precautionary steps to ensure the ongoing security and integrity of its services.

As part of these measures, passwords have been reset and OAuth tokens revoked. Some users may therefore be prompted to reset their password or re-authenticate when accessing certain sites.

GovCMS continues to investigate the activity as a priority and is closely monitoring the platform. Further updates will be provided as the investigation progresses.

We appreciate your patience and understanding while these important security measures are undertaken.
Nov 4, 10:50 AEDT
Update - We are continuing to investigate the issue. In the meantime, GitLab remains unavailable. We will let you know when it’s back up and running
Nov 4, 09:20 AEDT
Update - We are continuing to investigate the issue. In the meantime, GitLab remains unavailable. We will let you know when it’s back up and running.
Nov 4, 08:10 AEDT
Update - Investigations are still underway. GitLab has been taken offline for a deeper dive. We will let you know when it’s back up and running.
Nov 3, 22:10 AEDT
Update - Investigations are still underway. GitLab has been taken offline for a deeper dive. We will let you know when it’s back up and running.
Nov 3, 21:38 AEDT
Update - SSH is unavailable.
- PaaS customers will not be able to SSH into your projects.
- SaaS customers are not impacted.

We are continuing to investigate the issue.
Nov 3, 18:49 AEDT
Investigating - We’re currently investigating an infrastructure issue that may be affecting deployments.
Bulk deployments to non-production environments has been paused.
Nov 3, 15:19 AEDT

Nov 9, 2026

Nov 8, 2026

No incidents reported.

Nov 7, 2026

No incidents reported.

Nov 6, 2026

Nov 5, 2026

Nov 4, 2026

Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Nov 4, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Nov 3, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 27, 07:00 AEDT

Nov 3, 2026

Nov 2, 2026

No incidents reported.

Nov 1, 2026

No incidents reported.

Oct 31, 2026

Emergency Maintenance - Addressing CVE-2026-98432
Completed - The scheduled maintenance has been completed.
Oct 31, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 30, 23:00 AEDT
Scheduled - We are aware of the recently disclosed Linux kernel vulnerability CVE-2026-98432 and will perform emergency maintenance to apply the updates required.

The work will take place during regular maintenance hours. During the maintenance, your sites may experience minor disruption to service
Oct 30, 15:56 AEDT

Oct 30, 2026

Oct 29, 2026

No incidents reported.

Oct 28, 2026

FYI: Notice of upcoming GovCMS D11 release 4.6.0
Completed - The scheduled maintenance has been completed.
Oct 28, 10:40 AEDT
Update - Deployment of GovCMS D11 release 4.6.0 is complete for production sites and is now commencing on non-production sites. The deployment block has now been lifted.
Oct 27, 13:39 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 06:00 AEDT
Scheduled - Advice
GovCMS will release the Drupal 11 (D11) distribution on Monday 26 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the MODERATELY CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained MODERATELY CRITICAL. The D11 distribution will continue to be supported after this update.

Thank you to everyone who reviewed their preview environment/s. This is the corresponding release to production that includes the Drupal Core 11.4.* and PHP 8.4.* updates.

SaaS Deployment schedule plan:
- Production and Non-Production deployments commence from 6:00AM (AEDT) Tuesday 27 October 2026.
- Production environments completed by 3:00PM (AEDT) Tuesday 27 October 2026.
- Non-Production environments completed by 10:00am (AEDT) Wednesday 28 October 2026.
- PaaS deployments schedules are not impacted.

Subscribe to the GovCMS Status Page https://communications.finance.gov.au/link/id/zzzz6adeec5dbe9a6165Pzzzz6abc64fd96aa8976/page.html to get real-time deployment updates.

Core Update:
Update drupal/core from 11.3.19 to 11.4.10
- https://www.drupal.org/project/drupal/releases/11.4.10

Modules updated:

Update drupal/symfony_mailer module from 1.6.2 to 2.0.2
- https://www.drupal.org/project/symfony_mailer/releases/2.0.2
Update drupal/pathauto module from 1.14.0 to 1.15.0
- https://www.drupal.org/project/pathauto/releases/8.x-1.15
Update drupal/events_log_track module from 4.0.2 to 5.0.0
- https://www.drupal.org/project/events_log_track/releases/5.0.0
Update drupal/modifiers module from 1.6.0 to 1.8.0
- https://www.drupal.org/project/modifiers/releases/8.x-1.8
Update drupal/search_api_solr module from 4.3.10 to 4.4.0
- https://www.drupal.org/project/search_api_solr/releases/4.4.0
Update drupal/entity_class_formatter module from 2.0.1 to 2.0.2
- https://www.drupal.org/project/entity_class_formatter/releases/2.0.2
Update drupal/encrypt module from 3.2.0 to 3.3.0
- https://www.drupal.org/project/encrypt/releases/8.x-3.3
Update drupal/entity_reference_display module from 2.0.5 to 2.0.6
- https://www.drupal.org/project/entity_reference_display/releases/2.0.6
Update drupal/ctools module from 4.1.0 to 4.1.1
- https://www.drupal.org/project/ctools/releases/4.1.1
Update drupal/paragraphs module from 1.21.0 to 1.23.0
- https://www.drupal.org/project/paragraphs/releases/8.x-1.23
Update drupal/dynamic_entity_reference module from 3.2.2 to 3.2.3
- https://www.drupal.org/project/dynamic_entity_reference/releases/3.2.3
Update drupal/recaptcha module from 3.4.0 to 3.5.0
- https://www.drupal.org/project/recaptcha/releases/8.x-3.5
Update drupal/focal_point module from 2.1.2 to 2.1.3
- https://www.drupal.org/project/focal_point/releases/2.1.3
Update drupal/linked_field module from 1.7.0 to 1.8.0
- https://www.drupal.org/project/linked_field/releases/8.x-1.8
Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
- https://www.drupal.org/sa-contrib-2026-200

What modules are added /removed in the distribution?

- drupal/jsonapi_extras module has been added to GOVCMSD11
- admin_toolbar_links_access_filter module has been removed from GOVCMSD11

Note: After upgrading to GovCMS 4.6.0, importing outdated symfony_mailer configuration will restore settings that the module’s update hook removed, and will cause regressions in the email feature.

Theme update reminders:

The following two themes have current Drupal Security Advisories. The theme is your responsibility; you will need to ensure it is updated prior to the deadlines:

Gin Admin Theme:
This Moderately Critical Advisory was published on 14 October 2026.
The deadline for this Moderately Critical advisory is 14 November 2026.
For more information: Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
- https://www.drupal.org/sa-contrib-2026-219

Bootstrap Theme
This Moderately Critical Advisory was published on 21 October 2026.
The deadline for this Moderately Critical advisory is 21 November 2026.
For more information: Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- https://www.drupal.org/sa-contrib-2026-236

SaaS actions
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.

❗ IMPORTANT NOTICE 1: deployments during maintenance window

During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.

❗ IMPORTANT NOTICE 2: update local environments

Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.

❗ IMPORTANT NOTICE 3: for customers with configuration management enabled

The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.

This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.

All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.

If no merge request is lodged after a release, then no configuration has changed and no further action is required.

PaaS actions
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:

GovCMS distribution

- latest files released on 26 October 2026
- available from GitHub release tag 4.6.0

GovCMS lagoon

- latest files released on 26 October 2026
- available from GitHub release tag 11.4.0

GovCMS scaffold

- latest files released on 15 September 2026
- available from GitHub release tag 4.1.0

GovCMS scaffold-tooling

- latest files released on 20 October 2026
- available from GitHub release tag 6.0.11

More information about how to update this can be found in the Knowledge Base.

In the pipeline

Configuration Management

As mentioned previously, prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Configuration management - Overview

Campfire

We are holding our first Campfire on Wednesday 28 October 1-2pm AEDT. GovCMS backlog discussion as the first topic. We’ll focus on where module requests have “requires more community feedback/interest”, giving community members an opportunity to discuss needs, share use cases and help shape potential future enhancements.
If you’ve submitted a module request, we’d encourage you to bring it to the campfire and be part of the discussion.
Oct 9, 10:16 AEDT
Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Oct 28, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 20, 07:00 AEDT
Incident History Powered by Atlassian Statuspage