Core dependency release cycles

Statement

Drupal core includes dependencies on external third-party libraries managed in both Composer and Yarn. Updates to the minimum requirements and pinned versions of these dependencies are managed to keep sites up to date while minimizing disruption.

Where possible, Drupal core updates dependencies according to semantic versioning. (For example, minor-level dependency updates are avoided in Drupal core patch releases.)

Dependencies may also be deliberately updated for critical or security issues where the dependency does not provide these fixes for older versions used by core. 

In some cases, dependency updates may include other breaking changes outside our control.

PHP (Composer) dependency updates

• Major releases of Drupal evaluate to the highest possible versions of most dependencies for the longest ongoing support, but major updates are evaluated on a case-by-case basis. (For example, Drupal 9 requires Symfony 4.4 even though Symfony 5.0 is available, because jumping from 3.4 (in Drupal 8) to 5 in Drupal 9 was determined to be too disruptive, and there was not enough time to make Drupal 9 fully compatible with Symfony 5.)

• Major-version dependency updates are only done in major releases, unless they are required for a security update or critical bug.

• Dependencies are typically only removed in major releases, to provide BC for tarball installations.

• Every minor release of Drupal updates dependencies to the latest compatible minor and patch versions.

• Minor version dependency updates are only done in minor releases, unless required to fix a security issue or critical bug.

• Patch-level updates may be done in patch releases to resolve bugs or security issues, but we do not provide patch updates in every patch release since there is a risk of disruption due to upstream regressions.

JavaScript dependency updates

• Every minor release of Drupal updates CKEditor to the latest version, which may be a new major version or include other BC breaks. This is necessary to keep up to date with frequent security updates. CKEditor does not use semantic versioning and does not have a regular release schedule.