Update - Deployments of D11 4.5.1.1 hotfix are complete for production sites and are now commencing on D11 non-prod sites.
The deployment block has been lifted.
Sep 30, 2026 - 12:19 AEST
The deployment block has been lifted.
Sep 30, 2026 - 12:19 AEST
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Sep 30, 2026 - 06:00 AEST
Sep 30, 2026 - 06:00 AEST
Scheduled - Deployments of D11 4.5.1.1 hotfix are complete for production sites and are now commencing on D11 non-prod sites.
The deployment block has been lifted.
Advice
We would like to inform you of the upcoming GovCMS Drupal 11 (D11) hotfix release and deployment. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained CRITICAL. The D11 distribution will continue to be supported after this update.
Core Update:
Update drupal/core from 11.3.16 to 11.3.17
(https://www.drupal.org/project/drupal/releases/11.3.17)
- Drupal core - Third-party libraries-SA-CORE-2026-013
(https://www.drupal.org/sa-core-2026-013)
Module Updates:
Update drupal/webform module from 6.3.0-rc2 to 6.3.1
(https://www.drupal.org/project/webform/releases/6.3.1)
- Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
(https://www.drupal.org/sa-contrib-2026-175)
- Webform - Moderately critical - Access bypass -SA-CONTRIB-2026-174
(https://www.drupal.org/sa-contrib-2026-174)
- Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
(https://www.drupal.org/sa-contrib-2026-173)
- Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
(https://www.drupal.org/sa-contrib-2026-172)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
(https://www.drupal.org/sa-contrib-2026-171)
- Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
(https://www.drupal.org/sa-contrib-2026-170)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
(https://www.drupal.org/sa-contrib-2026-169)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
(https://www.drupal.org/sa-contrib-2026-168)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
(https://www.drupal.org/sa-contrib-2026-167)
- Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
(https://www.drupal.org/sa-contrib-2026-166)
- Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
(https://www.drupal.org/sa-contrib-2026-165)
- Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
(https://www.drupal.org/sa-contrib-2026-164)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-163
(https://www.drupal.org/sa-contrib-2026-163)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-162
(https://www.drupal.org/sa-contrib-2026-162)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-161
(https://www.drupal.org/sa-contrib-2026-161)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-160
(https://www.drupal.org/sa-contrib-2026-160)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-159
(https://www.drupal.org/sa-contrib-2026-159)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-158
(https://www.drupal.org/sa-contrib-2026-158)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-155
(https://www.drupal.org/sa-contrib-2026-155)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-154
(https://www.drupal.org/sa-contrib-2026-154)
Deployment schedule:
- Deployment to commence from 6am Wednesday 30 September 2026 and will be conducted throughout the daytime.
- Production branches completed by 3pm Wednesday 30 September 2026
- Non-Production branches completed by 10am Thursday 1 October 2026
As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. PaaS deployments schedules are not impacted.
SaaS Actions:
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.
IMPORTANT NOTICE 1: deployments during maintenance window
During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.
IMPORTANT NOTICE 2: update local environments
Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.
IMPORTANT NOTICE 3: for customers with configuration management enabled
The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.
This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.
All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.
If no merge request is lodged after a release, then no configuration has changed and no further action is required.
PaaS Actions:
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (29 September 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.5.1.1
- GovCMS lagoon (29 September 2026) > https://github.com/govCMS/lagoon/releases/tag/11.3.8.3
- GovCMS scaffold (15 September 2025) > https://github.com/govCMS/scaffold/releases/tag/4.1.0
- GovCMS scaffold-tooling (24 August 2026) >
https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.9
In the Pipeline:
Drupal Core 11.4.x Preview
GovCMS is midway through the preview periodfor the next Drupal Core update from 11.3.x to 11.4.x and PHP update from 8.3 to 8.5. The preview feature branch will be available for available 16 September – 7 October
Configuration Management
Prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Knowledge Base article: https://govcms.freshdesk.com/support/solutions/articles/51000490006
If you have any concerns, raise a ticket at https://www.govcms.support
Sep 30, 2026 06:00 - Oct 4, 2026 11:00 AEDT
The deployment block has been lifted.
Advice
We would like to inform you of the upcoming GovCMS Drupal 11 (D11) hotfix release and deployment. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained CRITICAL. The D11 distribution will continue to be supported after this update.
Core Update:
Update drupal/core from 11.3.16 to 11.3.17
(https://www.drupal.org/project/drupal/releases/11.3.17)
- Drupal core - Third-party libraries-SA-CORE-2026-013
(https://www.drupal.org/sa-core-2026-013)
Module Updates:
Update drupal/webform module from 6.3.0-rc2 to 6.3.1
(https://www.drupal.org/project/webform/releases/6.3.1)
- Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
(https://www.drupal.org/sa-contrib-2026-175)
- Webform - Moderately critical - Access bypass -SA-CONTRIB-2026-174
(https://www.drupal.org/sa-contrib-2026-174)
- Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
(https://www.drupal.org/sa-contrib-2026-173)
- Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
(https://www.drupal.org/sa-contrib-2026-172)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
(https://www.drupal.org/sa-contrib-2026-171)
- Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
(https://www.drupal.org/sa-contrib-2026-170)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
(https://www.drupal.org/sa-contrib-2026-169)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
(https://www.drupal.org/sa-contrib-2026-168)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
(https://www.drupal.org/sa-contrib-2026-167)
- Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
(https://www.drupal.org/sa-contrib-2026-166)
- Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
(https://www.drupal.org/sa-contrib-2026-165)
- Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
(https://www.drupal.org/sa-contrib-2026-164)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-163
(https://www.drupal.org/sa-contrib-2026-163)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-162
(https://www.drupal.org/sa-contrib-2026-162)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-161
(https://www.drupal.org/sa-contrib-2026-161)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-160
(https://www.drupal.org/sa-contrib-2026-160)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-159
(https://www.drupal.org/sa-contrib-2026-159)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-158
(https://www.drupal.org/sa-contrib-2026-158)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-155
(https://www.drupal.org/sa-contrib-2026-155)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-154
(https://www.drupal.org/sa-contrib-2026-154)
Deployment schedule:
- Deployment to commence from 6am Wednesday 30 September 2026 and will be conducted throughout the daytime.
- Production branches completed by 3pm Wednesday 30 September 2026
- Non-Production branches completed by 10am Thursday 1 October 2026
As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. PaaS deployments schedules are not impacted.
SaaS Actions:
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.
IMPORTANT NOTICE 1: deployments during maintenance window
During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.
IMPORTANT NOTICE 2: update local environments
Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.
IMPORTANT NOTICE 3: for customers with configuration management enabled
The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.
This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.
All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.
If no merge request is lodged after a release, then no configuration has changed and no further action is required.
PaaS Actions:
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (29 September 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.5.1.1
- GovCMS lagoon (29 September 2026) > https://github.com/govCMS/lagoon/releases/tag/11.3.8.3
- GovCMS scaffold (15 September 2025) > https://github.com/govCMS/scaffold/releases/tag/4.1.0
- GovCMS scaffold-tooling (24 August 2026) >
https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.9
In the Pipeline:
Drupal Core 11.4.x Preview
GovCMS is midway through the preview periodfor the next Drupal Core update from 11.3.x to 11.4.x and PHP update from 8.3 to 8.5. The preview feature branch will be available for available 16 September – 7 October
Configuration Management
Prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Knowledge Base article: https://govcms.freshdesk.com/support/solutions/articles/51000490006
If you have any concerns, raise a ticket at https://www.govcms.support
Sep 30, 2026 06:00 - Oct 4, 2026 11:00 AEDT
About This Site
GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io
GovCMS Hosting and Infrastructure
Operational
Hosting Infrastructure (Amazon EKS)
Operational
Akamai CDN cache
Operational
AWS Compute (Sydney)
Operational
AWS S3 Storage (Sydney)
Operational
AWS LoadBalancer (Sydney)
Operational
GovCMS E-mail relay (AWS Simple Email Service)
Operational
HTTPS Redirect Service
Operational
GovCMS Projects
Under Maintenance
Individual websites
Under Maintenance
GovCMS Sites Dashboard
Operational
GovCMS Sites Logging System (OpenSearch)
Operational
GovCMS GitLab
Operational
Deployment Infrastructure
Operational
Lagoon API
Operational
Akamai API
Operational
Lagoon tasks
Operational
GovCMS Service Desk (Freshdesk)
Operational
Freshdesk email notifications
Operational
Freshdesk search
Operational
Freshdesk incoming emails
Operational
Freshdesk outgoing emails
Operational
Other
Operational
Pygmy
Operational
Docker Desktop
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.
Scheduled Maintenance
Regular Weekly Maintenance - GovCMS Oct 6, 2026 23:00 - Oct 7, 2026 06:00 AEDT
We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Sep 29, 2026 - 06:00 AEST
Posted on Sep 29, 2026 - 06:00 AEST