FAQs about the Nov. 1, 2023 Drupal 9 End of Life

November 1, 2023 will mark the second time in Drupal's history that a version's end-of-life date signals a true hard stop, with no possibility of extended support and no commercial vendors that are in a position to provide off-grid security maintenance and bug fixes.

This was the case in November 2021 when Drupal 8 was end of lifed, due to the decommissioning of Symfony 3, and it will be the case this November for Drupal 9 with the decommissioning of Symfony 4.

Drupal 10 is built upon the Symfony 6.2 technology stack, and Drupal 10's leap from the Symfony 4 PHP framework to Symfony 6.2 is compounding the upgrade imperative. Major risks are associated with a site that's built upon an outdated and unsupported PHP framework.

Drupal 9 site owners, as well as those who are still on Drupal 8, are urged to upgrade to Drupal 10 ASAP.

Fortunately, the upgrade from Drupal 9 to 10, and even Drupal 8 to 10 is relatively straightforward process. Current Drupal version upgrades bear little resemblance to the inherently major undertaking that accompanied migration from Drupal 7.

While upgrading to Drupal 10 is very much a "have to" at this point, it's important to keep in mind that it's important to keep in mind that Drupal 10 and the recently released Drupal 10.1 represent exciting new directions for the CMS, and a host of advantages for site builders. 

Here are answers to the questions we're hearing a lot these days, along with top recommendations concerning what to do now. 

What does end of life mean in the Drupal world?

End of life signals the cessation of Drupal Community support, bug fixes, security updates, and any further core development. 

Prior to Drupal 8, when a Drupal version reached end of life, commercial vendors stepped in to fill the void with the option of paid support packages. This is no longer the case due to the fact that Drupal is now built on top of Symfony.  

What is Symfony?

Symfony is a PHP framework for web projects that optimizes efficiencies in the creation and maintenance of PHP web applications, while leveraging a set of 50 reusable components. It is one of the most popular, reliable, and mature PHP frameworks available.

Why is Drupal is now built on top of the Symfony PHP web application framework?

Here are five reasons:

1. Improved performance and scalability. Symfony components are designed to be lightweight and efficient, which helps to improve the overall performance and scalability of Drupal.
2. Better maintainability. The use of Symfony components and conventions in Drupal makes the codebase more organized and consistent, which makes it easier to maintain and extend.
3. Improved development experience. Symfony provides a set of well-documented, reusable components and tools that can be leveraged by developers to build Drupal sites more quickly and efficiently.
4. Better integration with other systems. Symfony's use of modern web development techniques, such as HTTP caching and routing, makes it easier to integrate Drupal with other systems and services.
5. A bigger developer community. Symfony is a widely used PHP framework, with an extensive community of developers who can contribute to and support Drupal.

Will a Drupal 9 CMS still function after November 1, 2023?

On November 2, Drupal 9 sites will continue to function as normal. We cannot predict the timeframe within which problems will begin to emerge, but it is likely just a matter of time. Once the Drupal Community stops issuing security releases and Symfony stops supporting the PHP code, potential vulnerabilities will run deep and wide. 

Security risks increase with each passing day after the November 1, 2023 end of life.

What’s the risk of further delaying migration from Drupal 8 or 9 to Drupal 10?

It’s not difficult to detect that a site is still on Drupal 8 or 9. Any organization that believes security is only an issue for sites that contain sensitive financial or medical data needs to question the potential organizational impact of their site being compromised or disabled.

There is no shortage of bad actors in the world for whom hijacking a site is seen as a sport. Failure to update can result in unnecessary exposure on many fronts.

Due to Symfony 4 and CK Editor 4 dependencies -- both of which are reaching end of life on November 1, 2023 -- Drupal 9 is facing a forced end of life, at the same time. End of life means a hard stop for Drupal 9 security fixes and community support. End of life for Drupal 7, however, which is not built on Symfony, has been extended to January 5, 2025. 

How long does it take to upgrade a site from Drupal 9 to Drupal 10?

From 10 hours or less on the low end to 50 hours on the high end. 

Upgrading from Drupal 9 core to Drupal 10 core is straightforward and simple. It’s the presence of contributed and custom modules, along with detection of any deprecations, that can delay or complicate the process. Drupal 9 contributed modules need to be evaluated to determine whether there is a supported upgrade path or if an alternative is required. Custom modules and themes also need to be individually reviewed to determine the upgrade path.

What if a Drupal 9 site has a module that does not have a Drupal 10 version?

The first step is to try and identify a replacement with similar functionality. If no good alternatives are found, site owners can opt to stay on the Drupal 9 version of the module, closely monitor the functionality, and watch for the release of an upgraded version. In some cases, site owners might opt to have a custom module written to handle the gap. 

If extended commercial support for Drupal 7 might be available after that version’s end-of-life date, why isn’t that the case for Drupal 8 and 9?

Drupal 8 and 9 are built upon Symfony. Drupal 7 isn't. 

Pandemic-related disruptions and the the fact that Drupal 7 migrations essentially require new site builds have caused the Drupal community to extend the Drupal 7 end-of-life date three times. At DrupalCon Pittsburgh 2023, a third and final Drupal 7 end-of-life extension was announced. Drupal Community support will remain through January 5, 2025. 

Will there be any sort of extension or grace period for upgrading to Drupal 10 following the November 1, 2023 end of life date? 

No. 

The end of life date is based on a third-party dependency on Symfony 4. As such, it’s a non negotiable hard stop.

What to do now?

Promet Source has developed a comprehensive package of Drupal 7, 8, and 9 upgrade capabilities to ensure a straightforward and seamless upgrade process. The Promet team of Drupal 10 upgrade experts is adept at working closely with clients to optimize outcomes while ensuring no disruption to current operations. Questions about next steps? Let's Talk.