Code freeze
A stretch of time before a release or launch when only approved fixes get merged. In Drupal core, a beta deadline and commit freezes play that role.
A code freeze is a period in which a team stops merging changes into a codebase, or lets in only agreed exceptions such as critical fixes, so that a release or launch stays stable. The phrase has no fixed rules in Drupal: core's change policy never uses it, and each project decides what its own freeze allows.
How it works in Drupal
Drupal core applies freezes in stages. Its allowed-changes policy calls the release of the first beta a firm deadline for all feature and API additions. Even an issue already marked reviewed and tested by the community (RTBC) when the commit freeze for the beta begins goes into the next minor release only. During the release candidate phase, the rules match those for patch releases. A patch release exists to give production sites bug fixes, and API and feature additions are not allowed there.
The core release cycle page adds a rhythm. A commit freeze on the affected branch is typically in place during a release window. As listed on 26 October 2026, the bugfix window for Drupal 11.4.x falls on the first Wednesday of each month and the security window on the third Wednesday.
The idea is older than today's policy. In a 2013 post about Drupal 8, Dries Buytaert treated code freeze as the point where new features stop arriving. Some features could still land until the first release candidate, as long as the count of critical bugs and tasks stayed under a threshold that fell each week.
On your own site, a freeze is a team agreement. Drupal does not enforce it. You decide the dates, the exceptions and the person who approves them.
Example
Before a product launch, a team posts a notice: from Monday 08:00 until launch, only the release manager can approve merges to the main branch, and the live site's configuration is read-only. A critical bug fix still goes through, with approval. Everything else waits in the repository and ships after the launch.
Common mistakes
- Freezing code but not configuration. Content types, fields and views are configuration, not code. The Drupal.org configuration guide advises against changes on a live site, and the Synchronize screen warns that such changes may be lost on the next import. The contributed Config Read-only mode module (
$settings['config_readonly'] = TRUE;) blocks configuration changes made in the admin interface. It lists Drupal 11 support (checked 26 October 2026). - No end date. Without one, nobody knows when queued work will ship.
- No rule for emergencies. Write the exception path down, including who can approve a security fix.
For marketing and content teams
A code freeze covers developer changes, not your editing. Publishing pages and articles continues. Ask whether new content types, layouts or configuration changes are also frozen, and plan campaign pages that need them for before the freeze starts.