The Long Road to Drupal 9

Drupal 9 is expected to launch mid-2020 but is it worth the wait?

• A couple questions can help you answer if you should upgrade to Drupal 8 or wait for Drupal 9
• And check out this guide if you want to be ready for Drupal 9

Why Drupal 9 at all? Aren't we adding features to Drupal 8 every six months?

Drupal 8 is the first major release to rely on significant third-party PHP dependencies. These dependencies, such as Symfony, Twig and Guzzle each have their own release and support cycles. As time goes on, our third party dependencies are gradually going to drop security support for the versions we rely on, and we'll then be faced with either forking the version we use to provide security coverage ourselves, or updating to the newer versions. Because Drupal directly exposes the APIs of some of its dependencies, major updates to dependencies can require API changes in Drupal core, and from there require releasing a new major version.

For example, Drupal 8 currently uses Symfony 3. Symfony 3 will reach end of life in November 2021, at which point it will cease to receive security fixes. Earlier versions of Drupal 8 relied on Symfony 2, and we upgraded to Symfony 3 during a minor release cycle.  Despite a lot of planning, that upgrade caused some backwards compatibility issues. While updating to Symfony 4 has not yet been fully analysed, ideally we would not wish to do that again.

Assuming Drupal 8 stays on Symfony 3, then ideally we'd want to release Drupal 9 with as long a window as possible prior to Symfony 3's EOL of November 2021. For example, if we want to give Drupal 8 site owners a 12 month window in which to upgrade their sites to Drupal 9, then ideally we'd want to release Drupal 9 by the second half of 2020. Otherwise, if we go later than this, in the worst case Drupal 8 will need to maintain a fork of Symfony 3 and manually backport security fixes from Symfony 4.

This need to stay on supported versions of dependencies is currently the main driver to releasing Drupal 9. Drupal 8 development is very active, with hundreds of commits making it into each minor release, and we know there is preparation to be done to make the transition to Drupal 9 as smooth as possible, which will take time to get right.

What about Drupal 7 EOL?

While the migration path is rapidly approaching stability, upgrading from Drupal 7 to Drupal 8 is not yet fully supported. The earliest we'll have an officially supported stable migration path from Drupal 7 to Drupal 8  will be in Drupal 8.6.0 in the second half of 2018, with some contributed modules following after that.

Drupal 7 still powers at least 0.9 million websites. Even if a further 2-300,000 sites migrate to Drupal 8 by 2020, we'll still have over 500,000 Drupal 7 sites left.

Drupal core has adopted a continuous upgrade path that allows module maintainers to gradually update their code without unpredictable backwards compatibility breaks. Because of this practice, we can allow modules to be compatible with both Drupal 8 and Drupal 9 at the same time, and also release major versions on a schedule (rather than waiting for APIs and features to be completed). This differs significantly from past releases, where module maintainers could not anticipate when a new major version would be released and had to deal with APIs continually breaking even if they tried to update before release. Whereas it used to make sense for some sites to 'skip' a Drupal major version, starting with Drupal 9, it will be easier to keep in step with Drupal core's own release cycle. This means it should not really matter to Drupal 7 site owners whether they update to Drupal 8 or Drupal 9, since as soon as they're on Drupal 8 or higher, future updates won't require a site rebuild and migration.

Therefore, we should discuss maintaining community support of Drupal 7 until some time in 2021 or 2022. I think it makes sense to begin this discussion now, and announce a date this year to give people the maximum amount of time to plan their upgrades. It used to be the case that major version support would drop the day that major version +2 came out, but since Drupal 8 to Drupal 9 will be an incremental change, and releases from Drupal 9 onwards can be scheduled, it seems like time to schedule the Drupal 7 EOL further in advance as well.

If 2021 or 2022 seems too soon, remember there are still 60,000 sites on Drupal 6, more than seven years since the release of Drupal 7, and more than two years after Drupal 6's EOL. It is also likely that something similar to the commercial LTS program for Drupal 6 will happen for Drupal 7 regardless of when official support is dropped. The current LTS program requires LTS vendors to release all security patches being released publicly to the community free of charge, so even after Drupal 7's EOL there will still be options for security support.

So what does the schedule look like?

A release timeline might end up looking something like the following, release numbers are examples only and all of this is purely to get a conversation started about these issues, we are still discussing things as core committers and with the security team too.
 

Proposal: Drupal 7 and 8 support both one year after 9.0.0.

In short, Drupal 8 and Drupal 7 both supported for one year after Drupal 9.0.0's release, after which both Drupal 8 and Drupal 7 sites are expected to have migrated to Drupal 9.

Given that it will be much easier to move from Drupal 8 to Drupal 9 than from Drupal 7 to Drupal 9, and we may set the Drupal 7 EOL well in advance, it could be that Drupal 7 ends up getting supported for longer than Drupal 8.

Alternate proposal: Drupal 8 support ends one year after 9.0.0, and Drupal 7 support ends two years after 9.0.0.

And Drupal 10?

Symfony's release schedule looks like the following:

• Symfony 5, November 2019
• Symfony 6, November 2021
• Symfony 7, November 2023

Each major Symfony release is supported for a total of five years. Symfony LTS releases are supported for three years each. (Other Drupal dependencies may have three-year cycles, or no particular schedule at all.)

Therefore, in order to benefit from security support from Symfony for the longest possible time, ideally we would release a major Drupal version within 6-12 months after each major Symfony release, giving us about four years of official security support from Symfony.

Future releases beyond Drupal 9 could potentially look like the following. By synchronising with Symfony's schedule, this would mean a 2 year development cycle for each major release, potentially with a further 2 years security support, notwithstanding PHP's cycle and the cycles of other dependencies which can make even four years challenging.

 

Conclusion

To balance all these conflicting priorities, the main thing to work on is making the transition from Drupal 8 to Drupal 9 as smooth as humanly possible, and this is work which can be done now. This means ensuring Drupal is not using deprecated code from its dependencies, that Drupal core's own deprecations are clearly documented, and to allow fully up-to-date Drupal 8 modules to work unmodified with Drupal 9.0.

To discuss release dates and EOL timing, there are issues for Drupal 7  and Drupal 8 and 9, more discussion in those issues is the next step towards setting dates.

 

Thanks to Gábor Hojtsy for preparing the images used in this post.