Drupal 7 End of Life (EOL) was originally planned for Nov. 2020, about ten years after the initial release of the platform. Given the large user base, this was subsequently extended to Nov. 2021. Then, to provide relief and support for everyone impacted by the pandemic Drupal 7 End of Life was extended another year, to Nov. 2022. The pandemic continues to have a major impact on our lives and our businesses and there continues to be a very large user base with over 550,000 websites running the framework - an awesome testament to how great of a platform it is. As such, the security team, and the founder of Drupal, as well as Tag1 and the other Drupal 7 Extended Support (D7ES) providers, felt extending the date another year was the best thing for Drupal and the Drupal community. To support the community, leadership has decided that D7 EOL will be postponed again, until Nov. 2023, and then re-assessed annually thereafter. The official PSA 2022-02-23 announcing this new change has just been posted.

We are here to answer your questions, and can provide insight and guidance to help you plan next steps and make decisions that are best for your organization. As an approved D7 Extended Support provider, and the #2 all time contributors – and creators of much of the Drupal platform itself – we are uniquely positioned to help you execute on those plans. Please reach out via email, or schedule a time to meet and discuss.

Drupal is so much more than a software framework. What makes Drupal so powerful is the Drupal community - the individuals and the organizations who contribute to and rely on the platform. As a community we have an obligation to support those who support us, and we believe this decision is the best thing for Drupal and the Drupal Community.

Moving forward, the decision to extend D7 EOL will be revisited annually. The result of the annual review could be another 1-year extension or the start date of a D7 Extended Support (D7ES) vendor program (likely along the lines of what had been previously planned). It is also possible that a new approach or model is developed based on ideas and input from the community. Be assured that at least 6 months notice (July 2023) will be given before any decision goes into effect.

What happens between now and Nov. 2023?

Everything will continue to operate the way it always has, and all updates will continue to be available via Drupal.org. The Drupal security team will provide security updates for Drupal 7 core, the community will be responsible for core development, overseen and guided by the D7 branch maintainers, and contributed module owners are responsible for their modules.

What does this mean for my site, or my organization?

Drupal puts you in control of your technology. The decision to upgrade to another version of Drupal, to migrate to another platform, or to continue running on Drupal 7 is a business decision unique to each organization's needs and goals. Even after Drupal 7 eventually goes End of Life (EOL), a robust ecosystem of Extended Support vendors will provide the security updates and support you need to continue to run the platform for many years. For example, Drupal 6 Long Term Support (similar to the planned D7ES program) was provided for six years after the D6 EOL date. Drupal 7 has a much larger install base, so organizations can expect that D7ES will be provided, and they can securely run and build on the platform until 2026 or even 2028, which is astounding.

What if a contributed module is no longer supported?

If a module you rely on is no longer being maintained, you can apply to become the new maintainer. The security team will continue to monitor the activity of contributed modules and mark contributed modules as “unsupported” if they are impacted by a security vulnerability and the maintainer has not addressed the issue. Again, anyone can apply to take over support and development of a module they rely on to work with the security team to remediate any issues.

  • New development for Drupal 7 has been very limited for the last few years. Even the most popular Drupal modules have mostly only received updates based on security issues - not new features.
  • The security team will not provide coverage or support for security issues on unsupported modules.
  • Unsupported modules are clearly marked; you can request ownership, or hire a D7ES vendor to help you update or modify the module.

How can D7ES vendors help me between now and 2023?

  • Drupal 7 Extended Support vendors can provide advice and guidance based on your business needs. Please reach out via email, or schedule a time to meet and discuss.
  • Vendors can support you in executing those decisions: from keeping sites secure and enabling you to continue to operate D7, to helping you migrate to another version of Drupal or to another platform.

Why is D7 EOL being delayed?

The Drupal community leadership reviewed statistics on the number of websites still using Drupal 7. Even 10+ years after its initial release there are still over 550,000 sites running D7. Ensuring those websites remain stable helps to ensure that businesses using Drupal 7 remain stable.

Do I need to do anything to my site to continue being supported?

You should always make a practice of ensuring your website has the most recent, compatible version of any software you’re using - especially if those versions involve security updates.

If your website is running modules that are still supported, you’re likely to remain secure for the next year or more, as long as you have a regular update process. If you’re running “unsupported” modules, you’ll either need to request maintainershop of the modules and work with the community to support them, or you will need to engage a Drupal 7 extended support vendor, like Tag1, to help you do this, or to do it for you.

How will this affect my custom code?

Custom code has never been supported by the Drupal Security team, or the project in general. Custom code has always been the responsibility of the website owner. This announcement does not affect custom code.

Should I still be migrating off of D7 if possible? What is the advantage of doing so?

Again, this is a business decision. For now, it’s not necessary, unless it makes sense for your organization to do so! The Drupal security team will continue to provide security updates for at least the next year, if not longer. Most Drupal 7 websites should continue to operate normally.

However, the number of developers creating new features for Drupal 7 is very small. If you want new features, or anything more than just security updates, you’ll either need to engage a D7 Extended Support provider, like Tag1, to add the features you need, or move off of Drupal 7.

If you have concerns about whether Drupal 7 will continue to support specific versions of your software stack, we recommend that you reach out to a D7 ES vendor for a consultation.

How can I donate to/support the Drupal project?

As always, you can contribute time, code, and documentation directly on Drupal.org. You can also make monetary donations to the Drupal Association to continue assisting with the project.

If you have any questions about the changes, what this means for your D7 sites, or want to discuss how Tag1 can help you with your plans to continue operating D7, or your migration to another platform, please send us an email, or schedule a time to meet with us.