What and why is this happening?
When this happens Drupal 9, and all Drupal 9 community contributed modules, will no longer be updated. This includes security updates. For sites to remain secure, they must upgrade to use Drupal 10 beforehand.
Time left until Drupal 9 is shelved
Like any modern software package, Drupal is built on top of several other code libraries, which are known as the project’s “dependencies”. The largest of these dependencies is the Symfony PHP framework. Drupal 9 uses Version 4 of this framework and that is scheduled for end of life in November this year, forcing Drupal to move to Symfony version 6. This move requires large portions of Drupal to be re-written to accommodate it, creating the Drupal 10 release and triggering the end of Drupal 9.
How easy is it to upgrade?
Now that Drupal 9 has been out long enough to be considered stable and production-ready, we've updated our Council Platform flagship product and the client sites that use it to Drupal 10. What we've found is that whilst upgrading Drupal's Core is relatively simple, the issue lies with the dozens of 3rd party modules a typical Drupal website has.
All these modules must be upgraded to a Drupal 10 compatible version. Whilst any given module may routinely be updated to a later version over the course of a website's life, there is no particular need to do so unless a security release is published, or specific functionality from a newer version is required. Updating modules requires testing and, when they break, remediation. It is normal for the majority of 3rd party modules in a site to not be upgraded for significant periods of time. This means to upgrade to Drupal 10 a large percentage of a site's community modules will require upgrading and testing. This can be an unavoidably time-intensive process due to the sheer number of modules involved. And of course, there are some modules that have no Drupal 9 compatible version.
How much work will my site need to be Drupal 10 ready?
To make your site Drupal 10 ready involves painstakingly updating your site's modules.
- To start, the site's version of PHP must be upgraded to v8.1
- Next, any modules not enabled must be reviewed and uninstalled if not needed.
- Modules that have a Drupal 10 version ready must be updated to that version. Some updated modules will display compatibility issues despite being advertised as Drupal 10 ready and must be fixed manually.
- Community-made modules with no Drupal 10 version must be manually fixed by your chosen web development agency.
- Custom modules created specifically for your site must be manually fixed by your chosen web development agency.
- The Drupal 9 core must be updated to Drupal 10.
- The site must be extensively tested so that undocumented issues can be logged and fixed.
To assess Drupal 10 readiness, a module called Upgrade Status has been created by the Drupal community. This module scans your site and tells the compatibility status of each module.
How long will all this take to fix?
It is rare that we run into a module that is irreparably broken or doesn't have an alternative available to replace it. The biggest time-consumer is cross-checking all the modules to make sure that minor updates don't cause conflicts or bugs. As a ballpark figure, we spend roughly one to one-and-a-half hours per module. Updating a core dependency can take longer.
To give you an idea of billable hours, a large site of 60 to 80 modules would take approximately two to three weeks to fully upgrade to Drupal 10, whilst a small site of a dozen or so modules would take around one week.
Our Council Platform clients really benefited from the product's unified codebase and identical sets of modules, as we upgraded the product behind the scenes to Drupal 10 and then were able to roll out this new version to each of our clients as part of their regular security updates.
We'd be happy to create a quote for the upgrade of your Drupal 9 site to Drupal 10, so you know exactly where you stand. To kick things off, please email us at info@zodiacmedia.co.uk with a brief introduction to your organisation and your Drupal site. One piece of advice we would definitely give is to not leave the upgrade process to the last minute, as many site owners are likely to be rushing to move to Drupal 10 before Drupal 9 becomes insecure after the 1st November this year!