Unpacking the Drupal PHP Support Lifecycle

Drupal, as a PHP-based CMS, is inextricably linked to the fast-moving PHP support lifecycle. But understanding PHP requirements for Drupal versions, and the timespan for which they support those PHP versions can be confusing.

In this blog, we look at the Drupal PHP version support lifecycle, including details on the Drupal release cadence and how it corresponds to the PHP release lifecycle, as well as variables that can alter the typical PHP Drupal version support schedule.

Understanding the Drupal Release Cadence

Before we can talk about how Drupal consumes PHP, it’s important to understand the typical Drupal pre-release and general availability release cadences.

In the chart below, which is an example from Drupal, you can see an example of the typical release and support cadence for a Drupal release -- including pre-release stages and GA release stages. As noted by Drupal, the exact schedule varies, and is typically maintained on the Drupal core release schedule.

Drupal Pre-Release Stages

Before Drupal versions are released to the public, they undergo a period of behind-the-scenes development. That development period is then followed by alpha releases, beta releases, and release candidate releases before it is released to the public as a general availability release.

Alpha releases represent the least stable release category, and typically contain a number of unresolved, known issues. Beta releases go a step beyond that, fixing most issues and allowing a somewhat stable platform for module and theme creators to start working toward compatibility. Release candidates are the next step, with generally stable code and no remaining critical bugs. Drupal does a good job of walking through these release stages here.

In the table below, you can see an applied example of these release stages as they occurred for Drupal 7.

Major Drupal versions can spend up to 2.5 years in development and pre-release phases. With the community cadence dictating two months in the beta release phase, and one month in release candidate phases. Drupal 7, for example, spent 562 days in development phase, 265 in alpha release phase, 55 days in beta release phase, and 35 days in release candidate phase before being released as a General Availability release. 

For minor Drupal versions, the post-development phase pre-release phases last around six weeks.

General Availability Releases

Drupal General Availability releases occur roughly every two years (recently declared as even years), with minor Drupal version releases for those major versions occurring every 6 months.

After Drupal 7 (which used decimal versioning), Drupal adopted semantic versioning. As an example, when this versioning approach is applied to X.Y.Z, X would represent a major version, Y would represent a minor version, and Z would represent a patch version. 

Breaking down the changes for each type of release, patch versions consist of bug fixes and security fixes, minor versions can introduce new features, and major versions can introduce backwards-incompatible changes.

Drupal Community Support Timeline

Like many open source projects, the Drupal community provides support (including new features, patches, and bug fixes) for Drupal versions along a specified timeline.

Recently, this community release and support schedule changed. Starting with Drupal 10, a major version is supported for at least four years. Major versions receive active support for two years after release, and maintenance and security support for two years after that.

Minor versions, on the other hand, are released every six months and receive 1 year of active community support (6 months of bug fixes and security patches, 6 months of security patches only).

Beyond major and minor Drupal versions, there’s also the matter of “LTS” versions. The terminal minor version for a major version (e.g. Drupal 9.5.0), is designated as a long-term support version and receives security patches for an additional amount of time determined by the community.

The chart below, for example, shows sample release schedule for the 10.x, 11.x, and 12.x Drupal releases. 10.3, a minor version, is supported for a total of one year, with a 6-month phase of active community support, and 6 months of security support.

Mittwald Managed Hosting Customers Stay Secure With Zend

mittwald, a global leader in web hosting, partnered with Zend to deliver value, security, and peace of mind to their customers, including those using Drupal.

Read the Case Study  Hosting Provider Solutions

The Drupal PHP Connection

Drupal uses and interacts with PHP in several fundamental ways. Namely, the Drupal core is written in PHP. Beyond the Drupal core, PHP is also used in Drupal themes, modules, templates, and in interactions between Drupal and database systems like MySQL or PostgreSQL.

Drupal provides a list of common ways in which Drupal interacts with PHP versions on their page “PHP Requirements.” These include database extensions, the XML extension, image library, OpenSSL, JSON, cURL, and Mbstring.

It's also worth noting that the recommended PHP version for a Drupal version can be impacted by its own underlying dependencies. Components from Symfony, for example, are used within the Drupal core library. This means that if Symfony requires a specific version of PHP, the Drupal version that incorporates that specific Symfony version will also need to require that specific PHP version. A recent example of that is with Drupal 10, which uses Symfony 6. Since Symfony 6 requires at least PHP 8.1, Drupal 10 also requires PHP 8.1.

Drupal PHP Version Support by Drupal Version

Drupal breaks PHP version support into two categories: “Compatible”, and “Recommended”. At a high level, Drupal tries to align PHP version support to the PHP community support lifecycle, cycling in new “recommended” versions as they’re made compatible within the Drupal ecosystem and removing recommended status for PHP versions that have reached community support end of life.

Compatible PHP Versions

Many pieces of software, including Drupal, have minimum operating requirements. For Drupal, this includes a minimum PHP version. Compatible versions detail the PHP versions that range from the minimum compatible version, to the latest supported version. By using a compatible PHP version, you ensure that Drupal core features will work as intended. However, a compatible version does not ensure that you receive the latest improvements, optimizations, or security updates found in newer PHP versions.

Recommended Versions

Drupal recommended PHP versions are versions recommended by the Drupal community. These recommended versions are recommended primarily because of their status as community-supported PHP versions, but also because they offer the best performance, security, and compatibility with Drupal themes, modules, and extensions.

Once a PHP version is no longer community supported, they typically are no longer listed as recommended versions. As an example, Drupal 9.5 (above) supports PHP 7.3 and 7.4, but Drupal does not recommend them for active use due to those versions being end of life.

Drupal 7 Supported PHP Versions

Drupal 7.92 and subsequent 7.x versions currently recommend use of PHP 8.1 and 8.2 (with 8.3 set to be supported and recommended soon).

Previously, Drupal 7.x versions supported PHP 5.6 and up, with PHP 7.2.x and up being the recommended versions.

Drupal 8 Supported PHP Versions

Drupal 8 requires at least PHP 5.5, but expanded to support up to PHP 7.4 before Drupal 8.9 reached end of life in November 2021. It is no longer recommended for use.

Drupal 9 Supported PHP Versions

Drupal 9.0.0 required at least PHP 7.4, and supported up to PHP 8.1. There are no plans for Drupal 9.x versions to support PHP versions beyond PHP 8.1.

Drupal 10 Requirements and Supported PHP Versions

PHP version: Drupal 10 requirements currently call for at least PHP 8.1, and recommends either PHP 8.1 or PHP 8.2. PHP 8.3 is on the roadmap for support/recommendation for Drupal 10.2 and above.

On-Demand Webinar: Are CMS Ecosystems Keeping Pace With PHP?

The PHP experts dive in on the state of PHP support within content management systems, including discussions on how Drupal ingests PHP, the current state of PHP support within Drupal, and more.

Keeping Up With Drupal PHP Requirements

Depending on the size or age of your application, managing the PHP support lifecycle within your Drupal-based application can be complex and time-consuming. In order to stay secure, and avoid incompatibilities long term, teams will need to regularly update the Drupal core, as well as manage PHP version compatibility for all themes, modules, and extensions used within the Drupal application.

Upgrades/Migrations

The most common way to keep up with PHP version requirements is to migrate/upgrade to the latest versions of Drupal, and the dependencies used within your application. That said, PHP upgrades and migrations (or Drupal version upgrades/migrations) might not always be possible without substantial changes to your dependencies, which makes selecting well-used and well-supported themes and modules even more important.

It's also important to note that Drupal is, in part, popular because it's highly customizable. This means that many enterprise Drupal sites will have substantially modified code. When upgrading/migrating, ensuring these customizations will work with both the new Drupal version and the new PHP version can add significant complexity.

As a rule of thumb, the more dependencies you have — and the more customizations you have applied to your Drupal application — the further in advance you should be planning, testing, and executing your PHP upgrades or migrations.  

Long-Term Support

In cases where you don’t have bandwidth to perform PHP upgrades as frequently as the PHP support lifecycle dictates, or where you would like to prioritize other development initiatives, obtaining long-term support via a third party is a good option to consider.

With PHP long-term support from a company like Zend, you can extend the PHP lifecycle for your application (including the lifecycle for dependencies that ingest/interact with PHP) by a minimum of two years beyond the PHP community support lifecycle.

Final Thoughts

For many organizations, keeping Drupal versions updated and aligned with community supported PHP shouldn’t be a major issue. However, for enterprise organizations that manage or host their own Drupal applications, keeping up with Drupal version and PHP version upgrades/migrations can pose a significant challenge – one that can ultimately divert time away from other critical development initiatives. Drupal aside, teams managing enterprise web applications will need to ensure that the PHP they ingest is kept up to date across their entire web infrastructure stack.

Luckily, there are options for teams who want to keep their Drupal applications protected against CVEs and compatibility issues – including migration services and PHP long-term support from Zend.

Need Help Keeping Your Drupal App on Supported PHP?

Zend can help. With expert migration services and long-term support for PHP, we can help keep your application supported and secure.

Explore Migration Services   See LTS Options 

Additional Resources

• Resource Collection - PHP Versions: Performance, Security, and Feature Comparisons
• White Paper - Planning Your Next PHP Migration
• White Paper - The Costs of Building PHP In House
• White Paper - The Hidden Costs of PHP Upgrades
• Solutions - PHP Hosting Providers Solutions
• Blog - PHP Community Support Lifecycle Changes: What Do They Mean for Your Team?
• Blog - The State of WordPress PHP Support
• Blog - How to Assess and Prevent PHP Vulnerabilities
• Blog - How to Configure nginx for Drupal 10 and PHP-FPM