[IT-SecNots] [Security-news] Drupal 7 will reach end-of-life in November of 2021 - PSA-2019-02-25

[security-news AT drupal.org]

View online: https://www.drupal.org/psa-2019-02-25

Date: 2019-February-25
Vulnerability:  Drupal 7 will reach end-of-life in November of 2021

Description: 
Drupal 7 was first released in January 2011. In November 2021, after over a
decade, Drupal 7 will reach end of life (EOL). (More information on why this
date was chosen [1].) Official community support for version 7 will end,
along with support provided by the Drupal Association on Drupal.org. This
means that automated testing services for Drupal 7 will be shut down, and
there will be no more updates provided by the Drupal Security Team.

When this occurs, Drupal 7 will be marked end-of-life in the update manager,
which appears in the Drupal administrative interface. Updates, security
fixes, and enhancements will no longer be provided by the community, but may
be available on a limited basis from select commercial vendors.

If you have a site that is running on Drupal 7, now is the time to start
planning the upgrade.  Note that the transition from Drupal 8 to Drupal 9
will not be the significant effort that the transition from 7 to 8 was. In
fact, the first release of Drupal 9 will be identical to the last release of
Drupal 8, except with deprecated code removed and dependencies updated to
newer versions. (See Plan for Drupal 9 [2] for more information on Drupal 9.)

What this means for your Drupal 7 sites is, as of November 2021:

  * Drupal 7 will no longer be supported by the community at large. The
    community at large will no longer create new projects, fix bugs in
    existing projects, write documentation, etc. around Drupal 7.
  * There will be no more core commits to Drupal 7.
  * The Drupal Security Team will no longer provide support or Security
    Advisories for Drupal 7 core or contributed modules, themes, or other
    projects. Reports about Drupal 7 vulnerabilities might become public
    creating 0 day exploits.
  * All Drupal 7 releases on all project pages will be flagged as not
    supported. Maintainers can change that flag if they desire to.
  * On Drupal 7 sites with the update status module, Drupal Core will show up
    as unsupported.
  * After November 2021, using Drupal 7 may be flagged as insecure in 3rd
    party scans as it no longer gets support.
  * Best practice is to not use unsupported software, it would not be
    advisable to continue to build new Drupal 7 sites.
  * Now is the time to start planning your migration to Drupal 8.

If, for any reason, you are unable to migrate to Drupal 8 or 9 by the time
version 7 reaches end of life, there will be a select number of organizations
that will provide Drupal 7 Vendor Extended Support (D7ES) for their paying
clients.  This program is the successor to the successful Drupal 6 LTS
program. Like that program, it will be an additional paid service, fully
operated by these organizations with some help from the Security Team.

The Drupal Association and Drupal Security Team will publish an announcement
once we have selected the Drupal 7 Vendor Extended Support partners.

If you would like more information about the Drupal release cycle, consult
the official documentation on Drupal.org. If you would like more information
about the upcoming release of Drupal 9, join us at DrupalCon Seattle.

.... Information for organizations interested in providing commercial Drupal
      7 Vendor Extended Support

Organizations interested in providing commercial Drupal 7 Vendor Extended
Support to their customers *and* who have the technical knowledge to maintain
Drupal 7 are invited to fill out the
application for the Drupal 7 Vendor Extended Support team [3]. The
application submission should explain why the vendor is a good fit for the
program, and explain how they meet the requirements as outlined below.

Base requirements for this program include:

  * You must have experience in the public issue queue supporting Drupal 7
    core or Drupal 7 Modules.  You should be able to point to a history of
    such contribution.  One way to measure this is issue credits, but there
    are other ways.   You must continue this throughout your enrollment in 
the
    program.  If you have other ways to show your experience, feel free to
    highlight them.
  * You must make a commitment to the Security Team, the Drupal Association,
    and your customers that you will remain active in this program for 3
    years.
  * As a partner, you must contribute to at least 20% of all Drupal 7 Vendor
    Extended Support module patches and 80% of D7ES core patches in a given
    year. (Modules that have been moved into core in Drupal 8 count as part 
of
    core metrics in Drupal 7) .
  * Any organization involved in this program must have at least 1 member on
    the Drupal Security Team for at least 3 months prior to joining the
    program and while a member of the program.  (See How to join the Drupal
    Security Team [4] for information.) This person will need a positive
    evaluation of their contributions from the Security Working Group.
  * Payment of an Drupal 7 Vendor Extended Support annual fee for program
    participation is required (around $3000 a year). These fees will go to
    communication tools for the Drupal 7 Vendor Extended Support vendors
    and/or the greater community.
  * Payment of a $450 application fee is required.
  * Your company must provide paid support to Drupal 7 clients.  This program
    is not for companies that don't provide services to external clients.
Application review process:


  1) We will confirm that each vendor meets the requirements outlined above
     and is a good fit for the program.
  2) If the Security Working Group does not think you are a good fit, we will
     explain why and decline your application. If you are rejected, you are
     able to reapply.  Most rejections will be due to Organizations not 
having
     enough ongoing contribution to  Drupal 7 and Organizations not having a
     Drupal Security Team member at their organization.
  3) The Drupal Association signs off on your participation in the program.
  4) If you are accepted, you will be added to the Drupal 7 Vendor Extended
     Support vendor mailing list.
  5) The Security Working Group will do a coordinated announcement with the
     vendors to promote the program.

If you have any questions you can email d7es at drupal.org


[1] https://www.drupal.org/blog/drupal-7-8-and-9
[2] https://www.drupal.org/blog/plan-for-drupal-9
[3] https://www.surveymonkey.com/r/D7ES
[4]
https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security-team

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news