[Security-news] Extending Drupal 7's End-of-Life - PSA-2020-06-24

[security-news at drupal.org]

View online: https://www.drupal.org/psa-2020-06-24

Date: 2020-June-24
Description: 
Previously, Drupal 7's end-of-life was scheduled for November 2021. Given the
impact of COVID-19 on budgets and businesses,  we will be extending the end
of life until *November 28, 2022*.  The Drupal Security Team will continue to
follow the Security Team processes [1] for Drupal 7 core and contributed
projects.

However, this means extra work from the Drupal community at large and the
security team in particular to review security reports, create patches, and
release security advisories for Drupal 7. This community effort will give
site owners more time while budgets recover, but the organizations that
sponsor security team members and the individual security team members who
volunteer their time could use your support. If you can, please donate to
support the end-of-life extension [2].

*Drupal 8 will still be end-of-life on November 2, 2021*, due to Symfony 3's
end of life [3]. However, since the upgrade path from Drupal 8 to Drupal 9 is
much easier, we don't anticipate the same impact on end-users.

.... What does this mean for my Drupal 7 site?

You can continue to run the site and get security updates via the normal
channels and processes.  This will give you an extra year to work on
converting your site to Drupal 9.

.. Do I need to upgrade to Drupal 8 before I upgrade to Drupal 9?

Migrating directly from Drupal 7 to Drupal 9 is supported with the core
Migrate module. Read more on preparing a Drupal 7 site for Drupal 9 [4].

.... How can I help?

*Consider donating [5] to support this effort.* If you are a representative
of a large end-user of Drupal, we'd love you to join the Drupal Association
and the security team as a partner.

You can also consider getting more involved in fixing issues in the issue
queue [6] or joining the Security Team [7] as a way to support the effort.

.... What about Drupal 7 Vendor Extended Support?

The extended support will now run from November 2022 until November 2025.
You can read more about the Druapl 7 Vendor Extended Support program [8].

.... What about contributed projects?

The Security Team will continue to follow the Security Team processes [9] for
contributed projects. Contributed project maintainers are asked to consider
supporting existing Drupal 7 releases if they are able.


[1] https://www.drupal.org/drupal-security-team/security-team-procedures
[2] http://drupal.org/security-team/donate
[3] https://symfony.com/releases/3.4
[4]
https://www.drupal.org/docs/understanding-drupal/drupal-9-release-date-and-what-it-means/what-happens-to-drupal-7-now-that
[5] http://drupal.org/security-team/donate
[6]
https://www.drupal.org/project/issues/drupal?text=&status=Open&priorities=All&categories=All&version=all_7.*&component=All
[7]
https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security-team
[8]
https://www.drupal.org/drupal-security-team/information-for-organizations-interested-in-providing-commercial-drupal-7
[9] https://www.drupal.org/drupal-security-team/security-team-procedures