The Drupal Association engineering team is announcing the end of life (EOL) of the first generation of the Automatic Update API, which relies on a different original signing solution for update validation than later versions.
Drupal.org’s APIs for Automatic Updates 7.x-1.x and 8.x-1.x will be discontinued on May 4th, 2026. These versions of automatic updates have been unsupported since the versions of Drupal core they are compatible with, 7 and 8, became unsupported.
Release contents hash files (example) will not be updated and will expire May 12th, 2026. They may be removed after this date with no notice.
In place updates (example) will no longer be generated after May 4th, 2026. These are generated on demand and existing update files will be removed.
APIs for supported versions of Automatic Updates will continue to be supported indefinitely.
Automatic Updates v1 was an important early step toward improving the safety and reliability of Drupal updates. However, its underlying signing and validation model has now been superseded by a more robust and secure approach, with TUF and Rugged.
Next steps
If you are still using Automatic Updates under the 7.x-1.x or 8.x-1.x branches, now is the time to plan your update to a supported version, or implement custom updates using the supported API with your own CI, etc. Doing so ensures continued support, improved security, and alignment with Drupal’s long-term update strategy.