Drupal 7 End-of-Life: The Final Extension

Over the last few years, we have heard that support is ending for Drupal 7. And now, Drupal has given us a final extension. We don't blame you if you think it sounds a little like the boy who cried wolf. 

So, let’s talk about what the Drupal Association’s latest deadline really means.

On June 7, 2023, the Drupal Association announced January 5, 2025, is Drupal 7’s looming end-of-life. This will be the final extension.

What does that mean if you’re running D7?

Support for moderately critical updates will be reduced

a id="support" style="position: relative; top: -180px;">

"Effective August 1, 2023, the Drupal Security Team may choose to publicly post moderately critical and less critical issues affecting Drupal 7 in the public issue queue for resolution, as long as they are not mass-exploitable." - End of life announcement and changes to Drupal 7 support

What does this mean?

It means that any bugs or minor security issues will not be fixed after August 1, 2023. Updates and fixes will only be issued for major security issues. Drupal 9 and above are not affected by this change. When a security issue affects Drupal 7 and Drupal 10, for example, the Drupal 10 security advisory may be released without a corresponding Drupal 7 fix, and the Drupal 7 issue is made public at that point.

Interested in learning how Drupal determines security risk levels? Click here

Unsupported Drupal 7 modules & themes will not receive updates

“Community support for contributed modules and themes will continue as it has to date. However, beginning August 1, 2023, once the Drupal 7 branch of a contributed module or theme is marked unsupported, it will not be eligible for new maintainership and will not be marked supported again. This will be true if an existing maintainer marks the module/theme unsupported or if the security team marks it unsupported for lack of response. If there are Drupal 7 modules or themes that you or your clients rely on, then we strongly encourage you to adopt these projects proactively.”

What does this mean?

If you use an unsupported module or theme, the community will no longer take responsibility for maintaining it or issuing updates. That means the onus is on your developers to fix bugs and maintain the module/theme yourself.

PHP 5.5 and below will no longer be supported on Drupal 7

“Effective August 1, 2023, we will no longer support PHP versions lower than 5.6 for Drupal 7. We may issue further PSAs increasing the minimum PHP requirement any time before Drupal 7's end of life.”

What does this mean?

The most recent version of PHP is 8.2 when writing this article. PHP 5.5 was released in 2013, with the latest update being made in 2016. So, it makes sense that Drupal no longer wants to support a processor that is three major versions behind the current technology.

Security fixes will no longer be provided for Drupal 7 Windows-only issues

“Effective August 1, 2023, we will no longer provide Drupal 7 security fixes for Windows-only issues. If you are running a Drupal 7 site on Windows, you should look into migrating to another operating system for hosting your site.”

What does this mean?

I can’t say it any better than Drupal has: If you are running a Drupal 7 site on Windows, you should look into migrating to another operating system for hosting your site.

Drupal.org will no longer package Drupal 7 distributions

“Effective August 1, 2023, Drupal.org will no longer create Drupal 7 distribution packages with Drush make files. If you need a distribution built, you can use drush make locally.”

What does this mean?

Maintaining distribution packages for Drupal 7 is no longer a priority for the community, so if you need to, you can build a distribution manually with Drush.

The bottom line

Once Drupal 7 reaches End-of-Life

• The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core, contributed modules and themes.
• Security issues for Drupal 7 may be publicly disclosed, and zero days (i.e., security vulnerabilities being exploited in the wild without advance warning) may occur.
• Drupal.org will no longer support tasks related to Drupal 7, including documentation navigation, automated testing, packaging, etc.
• All Drupal 7-compatible releases on project pages will be flagged as unsupported.
• Some Drush functionality for Drupal 7 will stop working as the underlying Drupal.org infrastructure will be removed.
• Drupal.org file archive packaging (tar and zip files) for Drupal 7 will be shut off.
• The archives may be removed.
• There will be no more core commits on Drupal core 7.x.
• Package tarballs may no longer be downloadable.
• External vulnerability scans will flag Drupal 7 as insecure.

If you haven’t already started moving off of Drupal 7, now is the time. Eighteen months may seem like a long time to plan, roadmap, architect and migrate to a new system, but it truly isn’t.

Get our software end-of-life guide and ensure your business is fully equipped for a replatforming project.

Need to talk about d7 end-of-life?

If you are running your site on Drupal 7, our Acro Commerce team is eager to talk and guide you through the process of upgrading to Drupal 10. Fill out the contact form below to start the conversation.

---

Editor's note: This article was originally published on July 26, 2023, and has been updated for freshness and accuracy.