Digital Peak Is the Latest Joomla Extension Vendor to Drop Joomla 4

Digital Peak announced today that it is “officially dropping Joomla 4 support for our Joomla extensions”. Future development and feature updates go to supported Joomla versions only, and its advice to anyone still on Joomla 4 is to upgrade to Joomla 6 now.

The same announcement commits to keep shipping security updates for DPCalendar 8.19.x on Joomla 3. The version two majors back keeps its patches while the one in between loses them, which sounds backwards until you look at who is running what.

Digital Peak is the latest in a run of Joomla extension vendors to leave Joomla 4 behind, thirteen of them since April 2025. If you manage Joomla sites for other people, the questions that raises are practical: which of your sites are on Joomla 4, and which of those run one of these extensions. mySites.guru records both for every connected site, and because it connects to every Joomla site from 1.5 through 6 (and will connect to Joomla 7 when it ships), a site stays monitored after its vendor drops the version it runs.

What Digital Peak announced

All Digital Peak Joomla extensions stop supporting Joomla 4: “our extensions will no longer support Joomla 4 compatibility. Future development and feature updates will focus on supported Joomla versions only.” DPCalendar 8.19.x on Joomla 3 keeps getting security updates, with the caveat that “this does not mean Joomla 3 or DPCalendar 8.19.x will receive ongoing feature development”. That branch has been in what Digital Peak called hybrid maintenance mode since May 2024, and the promise has been kept: 8.19.4, 8.19.5 and 8.19.6 all shipped between July and September 2026, and 8.19.6 is the current Joomla 3 security build. It has been a busy year for DPCalendar security, between the unauthenticated SQL injection we found in DPCalendar in July and the September security releases Digital Peak shipped for both branches after a Claude audit.

The announcement also sets the policy for next time. “Once Joomla 6 enters its security-only maintenance phase, we will drop Joomla 5 support for our extensions”, and a Joomla version “will be supported for another extra year while officially still being EOL”. Mapped onto Joomla’s published dates: Joomla 5 security support ends on 12 October 2027 and Joomla 6 enters its security-only phase on 17 October 2028, so Joomla 5 keeps Digital Peak support for roughly a year past its own end of life. Joomla 4 got about thirteen months by the same measure, from 14 October 2025 to today.

Nothing has been pulled yet. The DPCalendar download page still lists Joomla 4.4 against 10.12.4, the current stable release from 29 October 2026, and the DPMedia 1.21.2, DPCases 3.8.1 and DPAttachments 5.8.1 pages all list Joomla 4.4, 5 and 6. The change applies to what comes next. A Joomla 4 site running today’s releases should treat them as the last it will get.

Why drop Joomla 4 and keep Joomla 3?

Because Joomla 4 was a waypoint and Joomla 3 was where sites got stuck, and the numbers show it. Across the Joomla sites mySites.guru monitors, Joomla 3 sites outnumber Joomla 4 sites about five to one, and among DPCalendar installs the gap is wider still.

A Joomla 3 site is where it is because leaving Joomla 3 is a full migration: a new template, extensions that may have no modern equivalent, and a project no one budgeted for. A Joomla 4 site is in a different position. Of the Joomla 4 sites in the mySites.guru dataset, 67.3% are already on 4.4.14, the final Joomla 4 release; 23.2% sit on 4.4.0 to 4.4.13 and 9.5% on 4.0 to 4.3. Two thirds of them are one in-place upgrade from Joomla 5. From a vendor’s chair that is a population that can move and has not pressed the button.

DPCalendar’s own install base makes the point more sharply. The branch Digital Peak chose to keep patching is the one with the users in it, and the one it dropped is close to empty.

The Joomla 3 slice is not in good shape, though. Of the DPCalendar installs on Joomla 3, 56.5% run 8.19.6, the current security build. The other 43.5% are behind it, and 26.7% are on versions older than 8.x altogether, so they get nothing from the maintenance branch. A security-only promise is worth as much as the number of sites that install the releases, and on that measure Digital Peak’s Joomla 3 record is better than its users’.

Joomla extension vendors dropping Joomla 4 so far

Every row below comes from the vendor’s own announcement, changelog or requirements page, read today, newest first.

How each vendor left decides how much warning its users got. Digital Peak, Kubik-Rubik and Alterbrains announced the change across their whole catalogue, in words, on a date. YOOtheme, Gantry, JCE, SP Page Builder, Phoca Cart, Kunena and J2Commerce did it by shipping a new major that needs Joomla 5 or 6 and leaving Joomla 4 sites on the older line; Kunena even held 6.4 back from every site on 6.3.x because some of those users were still on Joomla 4.4. Kunena has since shipped security releases for both of its current lines, 7.1.1 and 6.4.17, and the fixes in 6.4.17 are only part of the set. YOOtheme has since shipped a critical security update for the Pro 5 line, and J2Store 4, the version that runs on Joomla 4 and 5, has its own end-of-life date of 19 October 2027.

JCH Optimize shows the risk. 9.4.0 raised the minimum to Joomla 5.0 with a line in the release notes, 9.3.1 in August was the last build listing Joomla 4.4, and when the 9.4.2 security release arrived, Joomla 4.4 sites were not offered it. The update did not appear, and nothing on the site said why. Gantry did the same this month, when 5.6.7’s security fix shipped with no Joomla 3 or 4 build. An update feed that stops offering anything is how most Joomla 4 sites will find out their vendor has gone, if they find out at all.

Who still supports Joomla 4

Plenty of Joomla extension vendors have made no announcement and, as of today, still publish builds that list Joomla 4.

That list is today’s position, and it will shrink. Alterbrains gave its users ten weeks between the announcement and the release. Every vendor on that list will release a next major at some point and decide whether it still builds for Joomla 4 or targets Joomla 6. Given the table above, expect the second answer.

What a Joomla 4 site should do now

Upgrade, in two hops. There is no direct path from Joomla 4 to Joomla 6: a Joomla 4.4 site goes to Joomla 5 first. Joomla 5 has been in its security-only phase since 13 October 2026, when 5.4.10 shipped as the last bugfix release, and its security support ends on 12 October 2027. So treat Joomla 5 as the stepping stone and Joomla 6 as the destination: 6.2.0 is current, with bugfix support until 17 October 2028 and security support until 16 October 2029.

1. 1

   Find them. List every Joomla 4 site you look after and the extensions each one runs, with versions. mySites.guru keeps both lists for every connected site.

   In our data two thirds of Joomla 4 sites are on 4.4.14 already; the ones on 4.0 to 4.3 need bringing to 4.4 before anything else.

2. 2

   Check the vendors. For each extension on each site, confirm there is a current build for Joomla 5 and for Joomla 6, using the table above and the vendor download pages.

   An extension with no Joomla 5 build is the item that decides the project, so find it before you start, not halfway through.

3. 3

   Upgrade to Joomla 5.4 on staging. Take a copy, run the Joomla 4.4 to 5.4 upgrade on it, fix what breaks, then repeat on the live site.

   There is no Joomla 4 to Joomla 6 path. Joomla 5 is a waypoint with a security end date of 12 October 2027, so do not stop there.

4. 4

   Go on to Joomla 6 and update the extensions in the same pass. Move the staging copy from 5.4 to 6.2, install the Joomla 6 builds of every extension, and test before repeating live.

   Doing the extension updates in the same window means one round of testing rather than two.

Joomla 5.4 Is Security-Only Since 13 October 2026Joomla 5.4 bug fixes ended 13 October 2026 and security fixes end 12 October 2027. What changed, the PHP 8.2 deadline that comes first, and planning Joomla 6.Read the full post

Finding your Joomla 4 sites with mySites.guru

Every site connected to mySites.guru reports its Joomla version on each snapshot, and Joomla 4 sites are flagged as end of life alongside Joomla 3 and anything older. Searching the Extension Inventory for DPCalendar, or for any extension in the table above, lists every connected site running it with the version each one reports. Which sites are on Joomla 4, and which of those run a vendor that has left, are then answered from one dashboard rather than an afternoon of logging in to sites one at a time.

The vulnerability rules cover the sites that cannot update. When a vendor releases a security fix that a Joomla 4 site cannot install, the rule keeps flagging that site, because it is still vulnerable. That is the JCH Optimize case from above: the update feed went silent and the flag did not.

Once a site has moved, the extension updates themselves run across every site from one dashboard. The sites that have not moved stay visible: mySites.guru connects to every Joomla site from 1.5 through 6 and will connect to Joomla 7 when it ships, and the 0.8% of Joomla 1.x and 2.x sites in the figures above are connected and reporting today.

All of this is part of the mySites.guru subscription. The plans are on the pricing page; connect the Joomla 4 sites first.