As of June 12, 2026, the old Drupal.org Automatic Updates API is retired and its legacy hash files have expired. If your site still depends on first-generation Automatic Updates assumptions, now is the time to clean up Composer, hosting, and deployment workflows before the next security advisory.
Drupal 9 has been unsupported since November 1, 2023. This guide shows how to audit an inherited site, keep the useful Composer and Drush habits, and plan a realistic Drupal 10 upgrade without underestimating risk.
Clean up composer.json with Composer Normalize, Composer validation, and CI checks so PHP dependency changes stay readable, repeatable, and easier to review.
Practical Composer guidance for Drupal teams: safer installs, cleaner dependency updates, faster conflict debugging, and Drush that matches each project.
