It feels like the last several years have seen significant shifts in the Drupal world and this year is no different. There are some major changes coming this year that will have significant impact on your work if you have Drupal sites. The good news is that I don’t think these are difficult changes to incorporate (in all but one case) but… as always, if you wait until well after the dates at hand, it will be much harder to be responsive. So, I wanted to throw some critical things out there now so you can plan and prepare. It’s better to be prepared and jump on these things early (to keep. the impact small).
Reminder: Drupal 8 End of Life
This one is technically a carry over from last year, but it bears reminding right up top. If you are still running Drupal 8 you are critically vulnerable. The Drupal and Symfony communities have moved on from Drupal 8.x and Symfony 3.x. As a result, this means that ever since November 2021 there have not been any security releases to remediate any vulnerabilities (regardless of their criticality). Does that mean you have a critical security vulnerability right now? I honestly don’t know. And neither do you, and neither does anyone else. And that’s the dangerous part.
The Drupal 8 to Drupal 9 update is not that hard. I would strongly strongly recommend that you jump on that ASAP and get it done because every day that goes by, you are more at risk! Some content I’ve posted on this to help includes:
PHP 7.4 End of Life
Technically, PHP 7.4 is already end of life. However, it will continue to receive security coverage through November 2022.
This means that your Drupal application needs to be updated to run Drupal 8.x well before that November timeframe. Obviously, different hosting providers are handling this EOL differently, so check with yours (e.g. Acquia has released that their support ends October 3, 2022).
The good news is that as long as you are running Drupal 9.1.x or higher, or Drupal 7.79 or higher, you should be fine. My colleague Gabor recently wrote about this.
I have only run into one PHP 8.x compatibility issue running on Drupal 9.x and it had to do with the SimpleSAMLPHP Auth module. However, recent versions of the module / library seem to have resolved the issue (and I don’t see an active issue for it on Drupal.org). TLDR I’ve been running PHP 8 for months now without any issue.
Want to know what’s compatible in your codebase (or more importantly, what’s not?) Use the PHPStan tool!
You can easily do this with:
composer require phpstan/phpstanCreate a phpstan.neon (config file) in your repository root. See their docs for more info, but here’s a simple example:
parameters:
level: 1
phpVersion: 80000 # PHP 8.0
paths:
- docroot/modules/custom
- docroot/themes/custom
Update the paths as needed. You may want to also scan your contributed modules to make sure they are compatible. Then, just run phpstan and don’t forget to pass in your config file!
vendor/bin/phpstan analyse -c phpstan.neonReminder: when you do update to PHP 8.x you will need to do so everywhere including your development, hosting, and continuous integration environments. I’ve blogged about this before to help you out!
Drupal 7.x End of Life
Another major end of life coming this year is Drupal 7. While some hosting providers will be providing ongoing, paid support for D7 through at least 2024 my strong recommendation is get off of Drupal 7. There. are so so many quality of life, architectural, coding best practices, and feature enhancements in the Drupal 8, 9, and 10 ecosystem that I don’t think you’ll be sorry.
Drupal 7 is scheduled to go end of life in November 2022. Obviously this is some time off, but the “update” out of D7 is an incredibly hard one. Why? Well, there isn’t actually an upgrade path from D7 to D8/D9/D10. You actually have to rebuild your platform. There are some tools out there (like Acquia’s Migrate Accelerate product, which is free for Acquia customers) that can certainly turbo charge this process. But even with this, you still have to rebuild. Which is I think why we still have so many sites on D7.
I get it, it’s a lot. But we are rapidly approaching the end of the road and I highly recommend that you start to take action on this sooner than later.
Drupal 10.x Release
As for Drupal 10, this one isn’t something you have to jump on immediately. Drupal 9 is currently slated to go end of life in 2023 so you have plenty of time to coast on 9.x without jumping to 10. But, my strong advise is to start prepping for the 10.x release ASAP and jump as soon as you’re able. All of my sites got updated to 9.x last year within a few months of its release and I haven’t had to sweat about that D8 EOL at all. I was off D8 well before it was even a factor. Sure, there is some danger in being an early adopter and note that I said “prep” for D10. Don’t feel like you have to jump immediately when it releases. But using tools like Upgrade Status (even now) to identify issues in your custom code, monitor the critical contributed modules that you are using for D10 readiness, trying to cut down on the number of patches you are running, etc. all make good sense and will simplify the update later on.
D10 is currently slated for June 2022!
In Conclusion
There’s a lot of really exciting progress coming this year and I hope you take advantage of it. Remember, there are a lot of DevOps best practices that you can (and should) have in place to really ensure that you are safely updating and not missing anything that could cause significant issues for your platform. Whatever you do though, don’t wait until the last minute. Get on these updates and be ready. We know they are coming. We know when they are coming. All that’s left is to prepare so we aren’t left behind.
Good luck!
Related Content
An overview of all the things I’ve been trying / testing to get ready for PHP 8.1.