Drupal.org to Discontinue Legacy Automatic Updates API on 4 May 2026

The affected versions correspond to Drupal core 7 and 8, both of which are already unsupported. APIs serving these branches will be discontinued on 4 May 2026.

Release contents hash files will expire on 12 May 2026 and may be removed after that date without notice. In addition, in-place update files will no longer be generated after 4 May 2026, and existing files will be removed.

Automatic Updates v1 introduced early safeguards for update validation, but its signing model has since been replaced by a more robust framework based on The Update Framework (TUF) and the Rugged delivery system. These newer mechanisms provide stronger validation and are used in supported versions of Automatic Updates.

APIs serving supported versions of the Automatic Updates module will continue to operate. The retirement applies only to the legacy 7.x-1.x and 8.x-1.x branches.

Site owners still relying on the deprecated branches are advised to migrate to supported update workflows or implement custom update processes using maintained APIs and continuous integration tooling. Continued use of the legacy API after May 2026 may result in failed update validation and security exposure.