Update - Deployment of GovCMS D11 release 4.6.0 is complete for production sites and is now commencing on non-production sites. The deployment block has now been lifted.
Oct 27, 2026 - 13:39 AEDT
Oct 27, 2026 - 13:39 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 2026 - 06:00 AEDT
Oct 27, 2026 - 06:00 AEDT
Scheduled - Advice
GovCMS will release the Drupal 11 (D11) distribution on Monday 26 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the MODERATELY CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained MODERATELY CRITICAL. The D11 distribution will continue to be supported after this update.
Thank you to everyone who reviewed their preview environment/s. This is the corresponding release to production that includes the Drupal Core 11.4.* and PHP 8.4.* updates.
SaaS Deployment schedule plan:
- Production and Non-Production deployments commence from 6:00AM (AEDT) Tuesday 27 October 2026.
- Production environments completed by 3:00PM (AEDT) Tuesday 27 October 2026.
- Non-Production environments completed by 10:00am (AEDT) Wednesday 28 October 2026.
- PaaS deployments schedules are not impacted.
Subscribe to the GovCMS Status Page https://communications.finance.gov.au/link/id/zzzz6adeec5dbe9a6165Pzzzz6abc64fd96aa8976/page.html to get real-time deployment updates.
Core Update:
Update drupal/core from 11.3.19 to 11.4.10
- https://www.drupal.org/project/drupal/releases/11.4.10
Modules updated:
Update drupal/symfony_mailer module from 1.6.2 to 2.0.2
- https://www.drupal.org/project/symfony_mailer/releases/2.0.2
Update drupal/pathauto module from 1.14.0 to 1.15.0
- https://www.drupal.org/project/pathauto/releases/8.x-1.15
Update drupal/events_log_track module from 4.0.2 to 5.0.0
- https://www.drupal.org/project/events_log_track/releases/5.0.0
Update drupal/modifiers module from 1.6.0 to 1.8.0
- https://www.drupal.org/project/modifiers/releases/8.x-1.8
Update drupal/search_api_solr module from 4.3.10 to 4.4.0
- https://www.drupal.org/project/search_api_solr/releases/4.4.0
Update drupal/entity_class_formatter module from 2.0.1 to 2.0.2
- https://www.drupal.org/project/entity_class_formatter/releases/2.0.2
Update drupal/encrypt module from 3.2.0 to 3.3.0
- https://www.drupal.org/project/encrypt/releases/8.x-3.3
Update drupal/entity_reference_display module from 2.0.5 to 2.0.6
- https://www.drupal.org/project/entity_reference_display/releases/2.0.6
Update drupal/ctools module from 4.1.0 to 4.1.1
- https://www.drupal.org/project/ctools/releases/4.1.1
Update drupal/paragraphs module from 1.21.0 to 1.23.0
- https://www.drupal.org/project/paragraphs/releases/8.x-1.23
Update drupal/dynamic_entity_reference module from 3.2.2 to 3.2.3
- https://www.drupal.org/project/dynamic_entity_reference/releases/3.2.3
Update drupal/recaptcha module from 3.4.0 to 3.5.0
- https://www.drupal.org/project/recaptcha/releases/8.x-3.5
Update drupal/focal_point module from 2.1.2 to 2.1.3
- https://www.drupal.org/project/focal_point/releases/2.1.3
Update drupal/linked_field module from 1.7.0 to 1.8.0
- https://www.drupal.org/project/linked_field/releases/8.x-1.8
Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
- https://www.drupal.org/sa-contrib-2026-200
What modules are added /removed in the distribution?
- drupal/jsonapi_extras module has been added to GOVCMSD11
- admin_toolbar_links_access_filter module has been removed from GOVCMSD11
Note: After upgrading to GovCMS 4.6.0, importing outdated symfony_mailer configuration will restore settings that the module’s update hook removed, and will cause regressions in the email feature.
Theme update reminders:
The following two themes have current Drupal Security Advisories. The theme is your responsibility; you will need to ensure it is updated prior to the deadlines:
Gin Admin Theme:
This Moderately Critical Advisory was published on 14 October 2026.
The deadline for this Moderately Critical advisory is 14 November 2026.
For more information: Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
- https://www.drupal.org/sa-contrib-2026-219
Bootstrap Theme
This Moderately Critical Advisory was published on 21 October 2026.
The deadline for this Moderately Critical advisory is 21 November 2026.
For more information: Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- https://www.drupal.org/sa-contrib-2026-236
SaaS actions
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.
❗ IMPORTANT NOTICE 1: deployments during maintenance window
During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.
❗ IMPORTANT NOTICE 2: update local environments
Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.
❗ IMPORTANT NOTICE 3: for customers with configuration management enabled
The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.
This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.
All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.
If no merge request is lodged after a release, then no configuration has changed and no further action is required.
PaaS actions
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
GovCMS distribution
- latest files released on 26 October 2026
- available from GitHub release tag 4.6.0
GovCMS lagoon
- latest files released on 26 October 2026
- available from GitHub release tag 11.4.0
GovCMS scaffold
- latest files released on 15 September 2026
- available from GitHub release tag 4.1.0
GovCMS scaffold-tooling
- latest files released on 20 October 2026
- available from GitHub release tag 6.0.11
More information about how to update this can be found in the Knowledge Base.
In the pipeline
Configuration Management
As mentioned previously, prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Configuration management - Overview
Campfire
We are holding our first Campfire on Wednesday 28 October 1-2pm AEDT. GovCMS backlog discussion as the first topic. We’ll focus on where module requests have “requires more community feedback/interest”, giving community members an opportunity to discuss needs, share use cases and help shape potential future enhancements.
If you’ve submitted a module request, we’d encourage you to bring it to the campfire and be part of the discussion.
Oct 27, 2026 06:00 - Oct 31, 2026 10:00 AEDT
GovCMS will release the Drupal 11 (D11) distribution on Monday 26 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the MODERATELY CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained MODERATELY CRITICAL. The D11 distribution will continue to be supported after this update.
Thank you to everyone who reviewed their preview environment/s. This is the corresponding release to production that includes the Drupal Core 11.4.* and PHP 8.4.* updates.
SaaS Deployment schedule plan:
- Production and Non-Production deployments commence from 6:00AM (AEDT) Tuesday 27 October 2026.
- Production environments completed by 3:00PM (AEDT) Tuesday 27 October 2026.
- Non-Production environments completed by 10:00am (AEDT) Wednesday 28 October 2026.
- PaaS deployments schedules are not impacted.
Subscribe to the GovCMS Status Page https://communications.finance.gov.au/link/id/zzzz6adeec5dbe9a6165Pzzzz6abc64fd96aa8976/page.html to get real-time deployment updates.
Core Update:
Update drupal/core from 11.3.19 to 11.4.10
- https://www.drupal.org/project/drupal/releases/11.4.10
Modules updated:
Update drupal/symfony_mailer module from 1.6.2 to 2.0.2
- https://www.drupal.org/project/symfony_mailer/releases/2.0.2
Update drupal/pathauto module from 1.14.0 to 1.15.0
- https://www.drupal.org/project/pathauto/releases/8.x-1.15
Update drupal/events_log_track module from 4.0.2 to 5.0.0
- https://www.drupal.org/project/events_log_track/releases/5.0.0
Update drupal/modifiers module from 1.6.0 to 1.8.0
- https://www.drupal.org/project/modifiers/releases/8.x-1.8
Update drupal/search_api_solr module from 4.3.10 to 4.4.0
- https://www.drupal.org/project/search_api_solr/releases/4.4.0
Update drupal/entity_class_formatter module from 2.0.1 to 2.0.2
- https://www.drupal.org/project/entity_class_formatter/releases/2.0.2
Update drupal/encrypt module from 3.2.0 to 3.3.0
- https://www.drupal.org/project/encrypt/releases/8.x-3.3
Update drupal/entity_reference_display module from 2.0.5 to 2.0.6
- https://www.drupal.org/project/entity_reference_display/releases/2.0.6
Update drupal/ctools module from 4.1.0 to 4.1.1
- https://www.drupal.org/project/ctools/releases/4.1.1
Update drupal/paragraphs module from 1.21.0 to 1.23.0
- https://www.drupal.org/project/paragraphs/releases/8.x-1.23
Update drupal/dynamic_entity_reference module from 3.2.2 to 3.2.3
- https://www.drupal.org/project/dynamic_entity_reference/releases/3.2.3
Update drupal/recaptcha module from 3.4.0 to 3.5.0
- https://www.drupal.org/project/recaptcha/releases/8.x-3.5
Update drupal/focal_point module from 2.1.2 to 2.1.3
- https://www.drupal.org/project/focal_point/releases/2.1.3
Update drupal/linked_field module from 1.7.0 to 1.8.0
- https://www.drupal.org/project/linked_field/releases/8.x-1.8
Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
- https://www.drupal.org/sa-contrib-2026-200
What modules are added /removed in the distribution?
- drupal/jsonapi_extras module has been added to GOVCMSD11
- admin_toolbar_links_access_filter module has been removed from GOVCMSD11
Note: After upgrading to GovCMS 4.6.0, importing outdated symfony_mailer configuration will restore settings that the module’s update hook removed, and will cause regressions in the email feature.
Theme update reminders:
The following two themes have current Drupal Security Advisories. The theme is your responsibility; you will need to ensure it is updated prior to the deadlines:
Gin Admin Theme:
This Moderately Critical Advisory was published on 14 October 2026.
The deadline for this Moderately Critical advisory is 14 November 2026.
For more information: Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
- https://www.drupal.org/sa-contrib-2026-219
Bootstrap Theme
This Moderately Critical Advisory was published on 21 October 2026.
The deadline for this Moderately Critical advisory is 21 November 2026.
For more information: Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- https://www.drupal.org/sa-contrib-2026-236
SaaS actions
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.
❗ IMPORTANT NOTICE 1: deployments during maintenance window
During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.
❗ IMPORTANT NOTICE 2: update local environments
Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.
❗ IMPORTANT NOTICE 3: for customers with configuration management enabled
The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.
This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.
All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.
If no merge request is lodged after a release, then no configuration has changed and no further action is required.
PaaS actions
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
GovCMS distribution
- latest files released on 26 October 2026
- available from GitHub release tag 4.6.0
GovCMS lagoon
- latest files released on 26 October 2026
- available from GitHub release tag 11.4.0
GovCMS scaffold
- latest files released on 15 September 2026
- available from GitHub release tag 4.1.0
GovCMS scaffold-tooling
- latest files released on 20 October 2026
- available from GitHub release tag 6.0.11
More information about how to update this can be found in the Knowledge Base.
In the pipeline
Configuration Management
As mentioned previously, prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Configuration management - Overview
Campfire
We are holding our first Campfire on Wednesday 28 October 1-2pm AEDT. GovCMS backlog discussion as the first topic. We’ll focus on where module requests have “requires more community feedback/interest”, giving community members an opportunity to discuss needs, share use cases and help shape potential future enhancements.
If you’ve submitted a module request, we’d encourage you to bring it to the campfire and be part of the discussion.
Oct 27, 2026 06:00 - Oct 31, 2026 10:00 AEDT
About This Site
GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io
GovCMS Hosting and Infrastructure
Operational
Hosting Infrastructure (Amazon EKS)
Operational
Akamai CDN cache
Operational
AWS Compute (Sydney)
Operational
AWS S3 Storage (Sydney)
Operational
AWS LoadBalancer (Sydney)
Operational
GovCMS E-mail relay (AWS Simple Email Service)
Operational
HTTPS Redirect Service
Operational
GovCMS Projects
Under Maintenance
Individual websites
Under Maintenance
GovCMS Sites Dashboard
Operational
GovCMS Sites Logging System (OpenSearch)
Operational
GovCMS GitLab
Operational
Deployment Infrastructure
Operational
Lagoon API
Operational
Akamai API
Operational
Lagoon tasks
Operational
GovCMS Service Desk (Freshdesk)
Operational
Freshdesk email notifications
Operational
Freshdesk search
Operational
Freshdesk incoming emails
Operational
Freshdesk outgoing emails
Operational
Other
Operational
Pygmy
Operational
Docker Desktop
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.
Scheduled Maintenance
Regular Weekly Maintenance - GovCMS Oct 27, 2026 23:00 - Oct 28, 2026 06:00 AEDT
We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Oct 20, 2026 - 07:00 AEDT
Posted on Oct 20, 2026 - 07:00 AEDT
Regular Weekly Maintenance - GovCMS Nov 3, 2026 23:00 - Nov 4, 2026 06:00 AEDT
We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Oct 27, 2026 - 07:00 AEDT
Posted on Oct 27, 2026 - 07:00 AEDT