FYI: Notice of upcoming GovCMS D11 hotfix 4.5.1.1

Scheduled Maintenance Report for GovCMS

Completed

The scheduled maintenance has been completed.
Posted Oct 01, 2026 - 10:20 AEST

Update

Deployments of D11 4.5.1.1 hotfix are complete for production sites and are now commencing on D11 non-prod sites.
The deployment block has been lifted.
Posted Sep 30, 2026 - 12:19 AEST

In progress

Scheduled maintenance is currently in progress. We will provide updates as necessary.
Posted Sep 30, 2026 - 06:00 AEST

Scheduled

Advice
We would like to inform you of the upcoming GovCMS Drupal 11 (D11) hotfix release and deployment. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained CRITICAL. The D11 distribution will continue to be supported after this update.

Core Update:
Update drupal/core from 11.3.16 to 11.3.17
(https://www.drupal.org/project/drupal/releases/11.3.17)
- Drupal core - Third-party libraries-SA-CORE-2026-013
(https://www.drupal.org/sa-core-2026-013)

Module Updates:
Update drupal/webform module from 6.3.0-rc2 to 6.3.1
(https://www.drupal.org/project/webform/releases/6.3.1)
- Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
(https://www.drupal.org/sa-contrib-2026-175)
- Webform - Moderately critical - Access bypass -SA-CONTRIB-2026-174
(https://www.drupal.org/sa-contrib-2026-174)
- Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
(https://www.drupal.org/sa-contrib-2026-173)
- Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
(https://www.drupal.org/sa-contrib-2026-172)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
(https://www.drupal.org/sa-contrib-2026-171)
- Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
(https://www.drupal.org/sa-contrib-2026-170)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
(https://www.drupal.org/sa-contrib-2026-169)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
(https://www.drupal.org/sa-contrib-2026-168)
- Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
(https://www.drupal.org/sa-contrib-2026-167)
- Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
(https://www.drupal.org/sa-contrib-2026-166)
- Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
(https://www.drupal.org/sa-contrib-2026-165)
- Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
(https://www.drupal.org/sa-contrib-2026-164)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-163
(https://www.drupal.org/sa-contrib-2026-163)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-162
(https://www.drupal.org/sa-contrib-2026-162)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-161
(https://www.drupal.org/sa-contrib-2026-161)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-160
(https://www.drupal.org/sa-contrib-2026-160)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-159
(https://www.drupal.org/sa-contrib-2026-159)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-158
(https://www.drupal.org/sa-contrib-2026-158)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-155
(https://www.drupal.org/sa-contrib-2026-155)
- Webform - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-154
(https://www.drupal.org/sa-contrib-2026-154)

Deployment schedule:
- Deployment to commence from 6am Wednesday 30 September 2026 and will be conducted throughout the daytime.
- Production branches completed by 3pm Wednesday 30 September 2026
- Non-Production branches completed by 10am Thursday 1 October 2026

As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. PaaS deployments schedules are not impacted.

SaaS Actions:

All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.

IMPORTANT NOTICE 1: deployments during maintenance window

During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.

IMPORTANT NOTICE 2: update local environments

Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.

IMPORTANT NOTICE 3: for customers with configuration management enabled

The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.

This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.

All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.

If no merge request is lodged after a release, then no configuration has changed and no further action is required.

PaaS Actions:
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (29 September 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.5.1.1
- GovCMS lagoon (29 September 2026) > https://github.com/govCMS/lagoon/releases/tag/11.3.8.3
- GovCMS scaffold (15 September 2025) > https://github.com/govCMS/scaffold/releases/tag/4.1.0
- GovCMS scaffold-tooling (24 August 2026) >
https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.9

In the Pipeline:

Drupal Core 11.4.x Preview
GovCMS is midway through the preview periodfor the next Drupal Core update from 11.3.x to 11.4.x and PHP update from 8.3 to 8.5. The preview feature branch will be available for available 16 September – 7 October

Configuration Management
Prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Knowledge Base article: https://govcms.freshdesk.com/support/solutions/articles/51000490006

If you have any concerns, raise a ticket at https://www.govcms.support
Posted Sep 25, 2026 - 10:48 AEST
This scheduled maintenance affected: GovCMS Projects (Individual websites).