So Outside Technology Security CMS
AnQiCMS
Online Demonstration

That week, the old branch was stopped just as the new version was released, what should the site running Drupal do first?

📅 2026-11-01 👁️ 0

The week of Drupal 12 release, Drupal 10 is exactly at the point of discontinuation of support, what should the Drupal site do first? First, do the backup acceptance, then discuss the upgrade scheduling. The official scheduling page writes the large version release window and the end of support next to each other, the site cannot rely on 'wait and see', nor should it directly move the main line without a recoverable backup.

Why would two time points collide in a week

Drupal's release rhythm is to provide a fixed support cycle for the main line first, and then let the next major version take over at the end of the cycle. According to the visible schedule on the day, Drupal 12 is scheduled to be released in the first week of December, and the end of support for Drupal 10 falls two days later in the same week. The collision is not an accident, but the result of scheduling design: the project binds 'new version available' and 'old version no longer secure' at the same time point, forcing the ecosystem to move forward.

The impact on the site is that you cannot stop at the old branch and wait, nor can you start the first migration evaluation on the day of the shutdown.

Timing point Actions to be completed by the site Common misjudgment
Three months before the shutdown Count module and theme compatibility Only check if there is a new version of the module
One month before the shutdown Complete one recoverable backup exercise Thinking that the backup file exists is the same as being able to recover
The week of the shutdown Freeze unnecessary changes Modify content and upgrade simultaneously in the same window
After stopping updates Migrate or move to controlled status Continue to provide write access externally

Check which backup to verify before upgrading

The backup is only considered verified if it has been restored once. Just exporting, without performing a restore, is the same as not doing a backup. The verification at least covers three things: whether the data itself can be imported into a clean environment, whether all attachments and static files are complete, and whether the site can log in and publish after restoration.

AnQiCMS in this scenario takes the approach of including data and static files in the backup and recovery capabilities, and the recovery drills can be done on independent instances. The self-built system in the v3.6.6 announcement simultaneously fixed two issues: list sorting parameter injection and the login credentials of site switching being forgeable. The suggested treatment is also the same sequence: backup first, then upgrade, and after the upgrade, rotate the signature configuration and change the administrator password. This sequence is also applicable to the preparation before migration when scheduling conflicts occur.

How to arrange the order of module compatibility

First, look at the writeable modules: forms, payment, import and export, comments, and member-related modules, which directly touch data and permissions; secondly, look at the modules that rewrite page output, such as cache, templates, and search engine-related modules; lastly, pure display modules.

When scheduling is tight, split the windows according to these three levels: postpone what can be postponed first, complete the writeable and authentication sides that must be done before the update is stopped, and pure display modules can be moved after the new main line is stable.

What are the choices after the old branch is stopped?

Three paths: migrate to the new main line; stay on the old branch but narrow the exposed surface, close the public write entry, and only retain static output; or rely on third-party support schemes that continue to provide patches for old versions. The second option is passive and only suitable as a transitional state, not suitable for long-term operation.

Common questions

Does the end of support mean stopping security patches as well?The end of major version support means that the official will no longer provide any patches, including security patches, which is a concept different from 'only stop feature updates'.

Will it be more stable to upgrade early?It is usually safer to migrate to a newer version still in the support cycle before the end of support, but it needs to be verified in a non-production environment first.

Is the release date always on time?The schedule is the official plan, but it may be delayed in practice. Sites should prepare according to the plan rather than bet on the plan.

Related articles

The core security version fixed over twenty issues in one go, where did the rollback patch stop on which branch?

When the core security version fixes more than twenty vulnerabilities at once, it is first necessary to clarify the statistical scope, and then to see where the patch追溯 stops on which branch. This article takes a round of repairs made public at the end of this month as an example, explaining the difference between the number of fixes and the number of announcements, the minimum support branch, and why versions below the minimum do not receive any patches, and provides the disposal sequence for sites still on the old branch and the acceptance list for self-built systems during emergency upgrades.

2026-11-01

Only about 10% of sites have installed llms.txt, can this number indicate that it is useless?

Only about one-tenth of the sites have installed llms.txt, can this adoption rate number indicate that it is useless? No. A low adoption rate indicates that it is not yet a common practice, and an unclear relevance indicates that it is not a lever for citation volume, neither of which equals invalid. This article separates the sample and scope boundaries of two studies, provides a way to judge it as a reading path rather than a ranking method, and explains how to cross-verify whether it has been read using crawl logs and site maps.

2026-11-01

AI answers mention the brand but do not provide a link, should the mention rate and citation rate be counted separately?

In AI answers, when mentioning a brand without providing a link, should the mention rate and citation rate be separated? Yes. Mention is the brand name appearing in the answer, and citation is the answer accompanied by a link to the source. These are different events, and merging statistics will understate or overstate visibility. This article explains the misjudgment caused by the difference in measurement criteria, provides a ledger field for separate recording, and describes two things that can be improved on the content side.

2026-11-01

Where does the difference lie in the content selection system of government portals and corporate official websites in terms of audit permissions and backup?

The emphasis of the content selection system of government portals and corporate official websites differs: the former prioritizes pre-publication review, sensitive word filtering, and permission stratification, while the latter prioritizes publication efficiency and column management. The backup range should cover data and static files, and recovery should be practiced at different rhythms. This article provides a checklist for the two types of sites.

2026-11-01

Vulnerabilities exploited in the wild must be reported within 24 hours, who should submit this report

Vulnerabilities exploited in the wild must be reported within 24 hours. This obligation extends to manufacturers and software maintainers who place products on the EU market, not all website operators. This article explains the effective time of the new regulations, early warnings, detailed announcements, and the three levels of time limits for final reports, who is considered to be the party that needs to report, and how unregulated sites can organize their emergency response procedures using the same timeline.

2026-11-01

There is an additional type of traffic from image search in the report, should this type of traffic be handled separately for content?

Is there a category of data found through image search in the report? Should the site create separate content for it? Do not open a new content line yet, but check if the image description is consistent with the text on the landing page. This article explains the statistics of this type of query initiated by images, its relationship with the original web page report, why the gray data is not aligned, and gives the judgment sequence of using a keyword library to fill in this type of query and distinguishing automatic image matching from manual image selection.

2026-11-01

How will the site that sends AI articles in batches judge the guide that adds a sentence that must be manually verified?

How will the site that publishes AI articles in batches determine it? The focus of the determination is on the purpose rather than the tool: creating pages in bulk to manipulate rankings is considered abuse, while fact-checking after辅助 creation does not belong. This article explains where this sentence has been changed, what specific checks are made before publication, and the step that is easily missed between in-site sensitive word filtering, content review, scheduled publishing, and bulk import.

2026-11-01

The visits brought by AI only account for one percent of the website traffic, why is the conversion rate higher?

Does the access recommended by AI only account for a little over 1% of the site traffic, but the conversion rate is significantly higher? Is this investment worth it? First, let's look at the differences in the scope of the two numbers: the proportion is counted according to the total site sessions, and the conversion is counted according to the recommendation channel, which cannot be directly divided. This article explains the differences in the samples, the order of judgment of the investment, and the actions that the site needs to take at both ends of being referred to and receiving conversions.

2026-11-01