FAQs about the Nov. 2023 Drupal 9 End of Life

November 2023 will mark the second time in Drupal's history that a version's end-of-life date signals a true hard stop, with no possibility of extended support and no commercial vendors that are in a position to provide off-grid security maintenance and bug fixes.

This was the case in November 2021 when Drupal 8 was end of lifed, due to the decommissioning of Symfony 3, and it will be the case this November for Drupal 9 with the decommissioning of Symfony 4. Drupal versions beginning with Drupal 8 are now built on top of the Symfony open source PHP web application framework. As such, the decommissioning of a Symfony version sparks end of life for the Drupal version upon which it was built. 

Fortunately, the migration from Drupal 9 to 10, and even Drupal 8 to 10 is relatively straightforward process -- more appropriately termed an upgrade than a migration. Current migrations and bear little resemblance to the inherently major undertaking that accompanied migration from Drupal 7.

Prior to Drupal's Symfony alignment, commercial vendors were able to step up following version end of life to offer extended commercial support.  That's no longer the case, which means that this November truly represents a hard stop for Drupal 9. 

Unwelcome surprises may be in store for Drupal 9 site owners as a result of security vulnerabilities and a lack of bug fixes and community support follows the November 2023 end of life.   

That's why we are urging all Drupal 9 site owners, as well as those who are still on Drupal 8, to upgrade to Drupal 10 ASAP.

We field questions from clients and the Drupal Community every day concerning the need to upgrade from Drupal 8 or 9 to Drupal 10 and the impact of the Drupal 9 end of life. Here are the key facts and stats concerning what’s next for Drupal sites and what to do now. 

Due to Symfony 4 and CK Editor 4 dependencies -- both of which are reaching end of life November 2023 -- Drupal 9 is facing a forced end of life, at the same time. End of life means a hard stop for Drupal 9 security fixes and community support. End of life for Drupal 7, however, which is not built on Symfony, has been extended to January 5, 2025. 

What does end of life mean in the Drupal world?

End of life signals the cessation of Drupal Community support, bug fixes, security updates, and any further core development. 

When previous versions of Drupal reached end of life, commercial vendors stepped in to fill the void with the option of paid support packages, but because of Drupal 9’s Symfony 4 dependency, which is reaching end of life in November of 2023, ongoing support is not available.

Will a Drupal 9 CMS still function after November 2023?

The day after the Drupal 9 end of life, Drupal 9 sites will continue to function as normal. We cannot predict the timeframe within which problems will begin to emerge, but it is absolutely just a matter of time. Once the Drupal Community stops issuing security releases and Symfony stops supporting the PHP code, potential vulnerabilities will run deep and wide. 

Security risks increase with each passing day after the November 2023 end of life.
 

What’s the risk of further delaying migration from Drupal 8 or 9 to Drupal 10?

It’s not difficult to detect that a site is still on Drupal 8 or 9. Any organization that believes security is only an issue for sites that contain sensitive financial or medical data needs to question the potential organizational impact of their site being compromised or disabled.

There is no shortage of bad actors in the world for whom hijacking a site is seen as a sport. Failure to update can result in unnecessary exposure on many fronts. 
 

How long does it take to upgrade a site from Drupal 9 to Drupal 10?

From 10 hours or less on the low end to 50 hours on the high end. 

Upgrading from Drupal 9 core to Drupal 10 core is straightforward and simple. It’s the presence of contributed and custom modules, along with detection of any deprecations, that can delay or complicate the process. Drupal 9 contributed modules need to be evaluated to determine whether there is a supported upgrade path or if an alternative is required. Custom modules and themes also need to be individually reviewed to determine the upgrade path.
 

What if my Drupal 9 site has a module that does not have a Drupal 10 version?

The first step is to try and identify a replacement with similar functionality. If no good alternatives are found, site owners can opt to stay on the Drupal 9 version of the module, closely monitor the functionality, and watch for the release of an upgraded version. In some cases, site owners might opt to have a custom module written to handle the gap. 
 

If extended commercial support for Drupal 7 might be available after that version’s end-of-life date, why isn’t that the case for Drupal 8 and 9?

Drupal 8 and 9 are built upon Symfony. Drupal 7 doesn’t.  

Pandemic-related disruptions and the the fact that Drupal 7 migrations essentially require new site builds have caused the Drupal community to extend the Drupal 7 end-of-life date three times. At DrupalCon Pittsburgh 2023, a third and final Drupal 7 end-of-life extension was announced. Drupal Community support will remain through January 5, 2025. 
 

Will there be any sort of extension or grace period for upgrading to Drupal 10 following the November 2023 end of life date? 

No. 

The end of life date is based on a third-party dependency with Symfony 4. As such, it’s a non negotiable hard stop.
 

What is Symfony?

Symfony is a PHP framework for web projects that optimizes efficiencies in the creation and maintenance of PHP web applications, while leveraging a set of 50 reusable components. It is one of the most popular, reliable, and mature PHP frameworks available.
 

What to do now?

Promet Source has developed a comprehensive package of Drupal 8 and 9 upgrade capabilities to ensure a straightforward and seamless upgrade process. The Promet team of Drupal 10 upgrade experts is adept at working closely with clients to optimize outcomes while ensuring no disruption to current operations. 
 
Promet’s focus on accessibility during every phase of strategy, planning, design, and development enhances efficiency while providing the confidence that backtracking will never be required to ensure the new site meets current ADA Section 508 web content accessibility guidelines. 
 
As a leading Drupal consulting, development, and support provider, we leverage a depth and breadth of skills and perspective, with a commitment to add value and share expertise every step of the way. 
 
Additional questions about Drupal migrations or the upcoming end of life for Drupal 9? Contact us today, we're happy to help.