At DrupalCon Global 2020, Tag 1 Consulting CEO Jeremy Andrews and Managing Director Michael Meyers talked about the upcoming Drupal 7 and Drupal 8 end of life. In their talk, they discussed:

  • What Drupal “End of Life” (EOL) means
  • When it happens, and how D7 and D8 differ
  • Why widely used versions are retired
  • Practical implications and your options
  • What Drupal vendor Extended Support (ES) Is
  • Why ES only covers D7, and not D8
  • How ES operates, and what it covers

What Drupal “End of Life” (EOL) means

When a version of Drupal reaches EOL, the Drupal community will no longer work on it or provide free support. Core development stops entirely - no new features are added, no bugs will be fixed. The core issue queues will be locked, you will be prevented from adding anything to Drupal 7 & 8 Core on Drupal.org.

While Drupal 6 Core is locked, contrib is still open. Drupal 7 & 8 will likely do the same, so you can update your modules. Very few 6.x modules were updated after the Drupal 6 EOL, and many maintainers closed their branches as well. Expect that most contrib module owners will close their 7 and 8 branches.

In addition to the issues queue, the testing infrastructure will most likely be decommissioned. The PHP versions supported by these versions of Drupal are also EOL. Each D7ES vendor has a member on the security team, but the Drupal security team will no longer be proactively involved in reviews. This may mean less secure code unless you participate in a D7ES program, or manually track patches as they become available.

When is the EOL date?

Drupal 7 reaches end of life in November of 2022.It was originally scheduled for November of 2021. The date was extended due to the large user base, and the difficulties stemming from the global coronavirus pandemic.

Drupal 8 reaches end of life on November 2, 2021. While it may be confusing that Drupal 8 reaches EOL before Drupal 7, Drupal 8 is dependent on Symfony 3, which reaches the Symfony community’s EOL at that time.

Why widely used versions are retired

There are many reasons to retire older software.

  • Legacy: Drupal 7 is 10 years old, and will be ~12 by EOL in Nov. 2022
  • Bandwidth: Developers can’t support Drupal 7 and 8 while building Drupal 9 and 10
  • Interest: Developers don’t want to focus on 10 year old technology
  • Innovation: Improvement through innovation is the best for Drupal as software

Drupal 7 and 8’s end of life is a challenge. Rebuilding your website on new technologies (which also have their own EOL schedules), can be expensive and time consuming. Drupal 8 to Drupal 9 is an easier upgrade, making its EOL less problematic for users.

Practical implications and your options

Drupal 7 users have several options. The higher cost options are:

  • Don’t migrate. This is a bad choice, because it leaves your website vulnerable to attack, potentially losing data.
  • Migrate to Drupal 9. This is a good choice, keeping your site up to date with a similar ecosystem.
  • Move to a new CMS. Similar in cost to a Drupal 9 migration, with the added cost of training your teams on new technologies.

Lower cost options are:

  • End of life your website.
  • Turn your website into a static website.
  • Keep running Drupal 7, and work with a Drupal 7 vendor in the Extended Support (D7ES) program.

What Drupal vendor Extended Support (ES) is

D7ES ensures Drupal 7 remains secure and safe to run. Companies approved to offer D7ES must provide at least the following services:

  • Security patches for D7 core, including vulnerabilities that are reported for supported versions of Drupal
  • A specific list of contributed modules will be identified, and security patches will be provided for them
  • Vendors must make a commitment to offer these services for at least 3 years; at a minimum, you should receive D7ES through 2025
  • All patches created by D7ES vendors must be open source - if a D7ES vendor fixes any problem with D7, they are obligated to release the fix
  • Vendors must have an active member on the Drupal Security Team

The more the community supports this effort, the more vendors will offer it, and the more fixes they’ll be able to provide. Official vendors are vetted by the Drupal Association and listed on the D7 Vendor Extended Support page. Drupal 7 ES does not follow a formal release schedule, and your website must be on the final EOL version of Drupal 7 in order to participate in the vendor programs.

To learn more about Tag1’s extended support program, see Tag1 Quo - the enterprise security monitoring service.

For more of Tag1's content for and about DrupalCon, see DrupalCons!

For more information on Tag1 Quo, see all of our Tag1 Quo content or visit the Tag1 Quo website at https://www.tag1quo.com/.

For all of Tag1's content on Drupal end-of-life and what you need to know, see Drupal D7 & D8 End of Life.

Photo by Ankhesenamun on Unsplash