GLPI 12.0.0 was released on 7 October 2026. For the 10 branch that was also the last day of support — the project tied it to GLPI 12's arrival, not to a calendar date. No further bugfixes or security patches are coming for 10.x, except under GLPI Network Extended Support. The supported branches are now 11 and 12.
It is not a release you drop in over a weekend.
The platform moves up
GLPI 12 requires at least PHP 8.3 and MariaDB 10.11 (or MySQL 8.0). GLPI 11 is content with PHP 8.2, so on those servers the GLPI upgrade quietly becomes a platform upgrade — different work, different risk, a different approval path. Check both versions on every instance before planning the migration itself.
Changes that are not in the feature list
- Knowledge base — categories are gone as a separate structure and an article can now contain other articles. After the upgrade the former categories stay hidden until an administrator grants access rights again. Until then users still see the articles they had access to, but without the category structure.
- Automatic actions — an action that fails five times in a row moves to ERROR status, one terminated externally to ABORTED. The status_msg string that the status checker reports for automatic actions now includes an ERROR count, so monitoring that parses it has to handle the new format.
- Reverse proxies — behind a proxy, the GLPI_TRUSTED_REVERSE_PROXIES and GLPI_REVERSE_PROXY_HEADERS constants have to be configured.
- Outbound requests — calls from the GLPI server into the internal network are now blocked unless explicitly authorized. The old GLPI_SERVERSIDE_URL_ALLOWLIST constant has been replaced.
- Inventory — configuration now requires an authentication method.
- API — v3 runs alongside the earlier versions. In custom asset schemas the state field was renamed to status; v2 keeps the original name.
Plugins are the longest item on the plan
Plugins have to be compatible with GLPI 12, and this time it is more than a version bump. Classes such as ComputerAntivirus, ComputerVirtualMachine, Item_Plug and Pdu_Plug are gone from the core, the DBmysql::query() and queryOrDie() methods were removed, and plugins must stop sending the hidden _glpi_csrf_token field and the X-Glpi-Csrf-Token header — CSRF protection is handled by the framework now. Custom modifications and your integration layer need the same review.
Five advisories on 7 October
On release day the project also published five security advisories. All five describe flaws already fixed in the September releases. Three belong to the releases of 16 September 2026 — two fixed in both 10.0.27 and 11.0.9, one in 11.0.9 only — and two to 10.0.28 and 11.0.10 of 30 September 2026. The most serious is the 11-only one, an XSS via form illustration import: High severity, CVSS v4 score 8.6. The other four are rated Medium. One of the five has a CVE assigned: CVE-2026-53631, an unauthorized expansion of visibility for knowledge base articles, reminders and RSS feeds.
If you skipped the September releases, you now know exactly what your installation is missing. And if you deployed 11.0.10, move to 11.0.11 of 1 October 2026 — it fixes a regression that prevented many plugins from being activated.
What to do before the maintenance window
- Establish the PHP and database version on every instance — one project, or two.
- Test the upgrade on a copy of production, not a clean test instance — your data and history are what matter.
- Prepare the knowledge base access rights and assign them immediately after the upgrade.
- Go through plugins and custom modifications and verify that GLPI 12 versions exist.
- Update automatic action monitoring for the new status format.
- Schedule the window with a backup and a tested rollback.
The 11 branch stays supported — support covers the two latest major versions, and under the project's lifecycle policy 11.0.0, released on 1 October 2025, gets bugfixes until roughly spring 2027 and security patches until roughly autumn 2027. Postponing GLPI 12 by a few months is a defensible decision. Postponing the move off GLPI 10 no longer is.