[Security-news] Drupal 7 will reach end-of-life in November of 2021 - PSA-2019-02-25

[security-news at drupal.org]

View online: https://www.drupal.org/psa-2019-02-25

Date: 2019-February-25
Vulnerability:  Drupal 7 will reach end-of-life in November of 2021

Description: 
Drupal 7 was first released in January 2011. In November 2021, after over a
decade, Drupal 7 will reach end of life (EOL). (More information on why this
date was chosen [1].) Official community support for version 7 will end,
along with support provided by the Drupal Association on Drupal.org. This
means that automated testing services for Drupal 7 will be shut down, and
there will be no more updates provided by the Drupal Security Team.

When this occurs, Drupal 7 will be marked end-of-life in the update manager,
which appears in the Drupal administrative interface. Updates, security
fixes, and enhancements will no longer be provided by the community, but may
be available on a limited basis from select commercial vendors.

If you have a site that is running on Drupal 7, now is the time to start
planning the upgrade.  Note that the transition from Drupal 8 to Drupal 9
will not be the significant effort that the transition from 7 to 8 was. In
fact, the first release of Drupal 9 will be identical to the last release of
Drupal 8, except with deprecated code removed and dependencies updated to
newer versions. (See Plan for Drupal 9 [2] for more information on Drupal 9.)

What this means for your Drupal 7 sites is, as of November 2021:

   * Drupal 7 will no longer be supported by the community at large. The
     community at large will no longer create new projects, fix bugs in
     existing projects, write documentation, etc. around Drupal 7.
   * There will be no more core commits to Drupal 7.
   * The Drupal Security Team will no longer provide support or Security
     Advisories for Drupal 7 core or contributed modules, themes, or other
     projects. Reports about Drupal 7 vulnerabilities might become public
     creating 0 day exploits.
   * All Drupal 7 releases on all project pages will be flagged as not
     supported. Maintainers can change that flag if they desire to.
   * On Drupal 7 sites with the update status module, Drupal Core will show up
     as unsupported.
   * After November 2021, using Drupal 7 may be flagged as insecure in 3rd
     party scans as it no longer gets support.
   * Best practice is to not use unsupported software, it would not be
     advisable to continue to build new Drupal 7 sites.
   * Now is the time to start planning your migration to Drupal 8.

If, for any reason, you are unable to migrate to Drupal 8 or 9 by the time
version 7 reaches end of life, there will be a select number of organizations
that will provide Drupal 7 Vendor Extended Support (D7ES) for their paying
clients.  This program is the successor to the successful Drupal 6 LTS
program. Like that program, it will be an additional paid service, fully
operated by these organizations with some help from the Security Team.

The Drupal Association and Drupal Security Team will publish an announcement
once we have selected the Drupal 7 Vendor Extended Support partners.

If you would like more information about the Drupal release cycle, consult
the official documentation on Drupal.org. If you would like more information
about the upcoming release of Drupal 9, join us at DrupalCon Seattle.

.... Information for organizations interested in providing commercial Drupal
       7 Vendor Extended Support

Organizations interested in providing commercial Drupal 7 Vendor Extended
Support to their customers *and* who have the technical knowledge to maintain
Drupal 7 are invited to fill out the
application for the Drupal 7 Vendor Extended Support team [3]. The
application submission should explain why the vendor is a good fit for the
program, and explain how they meet the requirements as outlined below.

Base requirements for this program include:

   * You must have experience in the public issue queue supporting Drupal 7
     core or Drupal 7 Modules.  You should be able to point to a history of
     such contribution.  One way to measure this is issue credits, but there
     are other ways.   You must continue this throughout your enrollment in 
the
     program.  If you have other ways to show your experience, feel free to
     highlight them.
   * You must make a commitment to the Security Team, the Drupal Association,
     and your customers that you will remain active in this program for 3
     years.
   * As a partner, you must contribute to at least 20% of all Drupal 7 Vendor
     Extended Support module patches and 80% of D7ES core patches in a given
     year. (Modules that have been moved into core in Drupal 8 count as part 
of
     core metrics in Drupal 7) .
   * Any organization involved in this program must have at least 1 member on
     the Drupal Security Team for at least 3 months prior to joining the
     program and while a member of the program.  (See How to join the Drupal
     Security Team [4] for information.) This person will need a positive
     evaluation of their contributions from the Security Working Group.
   * Payment of an Drupal 7 Vendor Extended Support annual fee for program
     participation is required (around $3000 a year). These fees will go to
     communication tools for the Drupal 7 Vendor Extended Support vendors
     and/or the greater community.
   * Payment of a $450 application fee is required.
   * Your company must provide paid support to Drupal 7 clients.  This program
     is not for companies that don't provide services to external clients.
Application review process:


   1) We will confirm that each vendor meets the requirements outlined above
      and is a good fit for the program.
   2) If the Security Working Group does not think you are a good fit, we will
      explain why and decline your application. If you are rejected, you are
      able to reapply.  Most rejections will be due to Organizations not 
having
      enough ongoing contribution to  Drupal 7 and Organizations not having a
      Drupal Security Team member at their organization.
   3) The Drupal Association signs off on your participation in the program.
   4) If you are accepted, you will be added to the Drupal 7 Vendor Extended
      Support vendor mailing list.
   5) The Security Working Group will do a coordinated announcement with the
      vendors to promote the program.

If you have any questions you can email d7es at drupal.org


[1] https://www.drupal.org/blog/drupal-7-8-and-9
[2] https://www.drupal.org/blog/plan-for-drupal-9
[3] https://www.surveymonkey.com/r/D7ES
[4]
https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security-team