FYI: Notice of upcoming GovCMS D11 update 4.5.1

Scheduled Maintenance Report for GovCMS

Completed

The scheduled maintenance has been completed.
Posted Aug 25, 2026 - 11:57 AEST

In progress

Scheduled maintenance is currently in progress. We will provide updates as necessary.
Posted Aug 25, 2026 - 06:00 AEST

Scheduled

Advice
We would like to inform you of an upcoming Drupal 11 (D11) release and deployment. It addresses a recent security advisory issued by Drupal.org. GovCMS assessed the MODERATELY CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained MODERATELY CRITICAL. The D11 distribution will continue to be supported after this update.

Core Update:
Update Drupal core from 11.3.14 to 11.3.16 (https://www.drupal.org/project/drupal/releases/11.3.16)
- Guzzle: URI fragments disclosed in redirect Referer headers - CVE-2026-67354 (https://github.com/advisories/GHSA-h95v-h523-3mw8)
- Guzzle: Host-only cookie scope is not preserved - CVE-2026-67355 (https://github.com/advisories/GHSA-wm3w-8rrp-j577)
- Guzzle: Unbounded response cookies risk denial of service - CVE-2026-67353 (https://github.com/advisories/GHSA-f283-ghqc-fg79)
- Guzzle: Proxy-Authorization headers can be sent to origin servers - CVE-2026-67339 (https://github.com/advisories/GHSA-94pj-82f3-465w)

Module Updates:
Entity Browser module from 2.15.0 to 2.16.0 (https://www.drupal.org/project/entity_browser/releases/8.x-2.16)
- Entity Browser - Cross site scripting-Moderately critical-SA-CONTRIB-2026-094 (https://www.drupal.org/sa-contrib-2026-094)
External Auth module from 2.0.12 to 2.0.13 (https://www.drupal.org/project/externalauth/releases/2.0.13)
- External Authentication - Access bypass -Moderately critical - SA-CONTRIB-2026-098- (https://www.drupal.org/sa-contrib-2026-098)
Diff module from 1.10.0 to 2.0.1 (https://www.drupal.org/project/diff/releases/2.0.1)
- Diff - Access bypass -Moderately critical -SA-CONTRIB-2026-096 (https://www.drupal.org/sa-contrib-2026-096)

Deployment schedule:
- Distribution release Monday 24 August 2026
- Production and Non-Production deployments commence from 6:00AM (AEST) Tuesday 25 August 2026
- Production environments completed by 10:00am (AEST) Wednesday 26 August 2026
- Non-Production environments completed by 10:00am (AEST) Thursday 27 August 2026
- PaaS deployments schedules are not impacted.

As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. We are wanting to give you as much lead time as possible, should you need to adjust your timeframes. PaaS deployments schedules are not impacted.

PaaS Actions:
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (24 August 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.5.1
- GovCMS lagoon (24 August 2026) > https://github.com/govCMS/lagoon/releases/tag/11.3.8.2
- GovCMS scaffold (8 December 2025) > https://github.com/govCMS/scaffold/releases/tag/4.0.0
- GovCMS scaffold-tooling (18 June 2026) > https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.8

In the Pipeline:

Configuration Management
GovCMS has been refining its stale configuration scripts. Prior to the next update 4.6.0, GovCMS will be implementing a scheduled monthly configuration cleanup exercise. For more information see Knowledge Base article: https://govcms.freshdesk.com/support/solutions/articles/51000490006

Drupal Core 11.4.x & PHP8.5 Preview
GovCMS is preparing for the next Drupal Core update from 11.3.x to 11.4.x and PHP update from 8.3 to 8.5. Plans are progressing for the previews in early September 2026. The preview feature branch will be available for 2 weeks. More information will be in the proactive tickets that will be created for all SaaS projects.

If you have any concerns, raise a ticket at https://www.govcms.support
Posted Aug 20, 2026 - 13:46 AEST
This scheduled maintenance affected: GovCMS Projects (Individual websites).