On February 13, 2008, Drupal 6 was released. The policy of the community is to support only the current and previous stable versions. (When Drupal 6 was released, Drupal 4.7.x was marked unsupported. When Drupal 7 came out, Drupal 5.x was marked unsupported.) This policy was created to prevent core and module maintainers from having to maintain more than 2 active major versions of Drupal.

With the coming Drupal 8 release, this policy has been questioned. We want to ensure that sites that wish to move from Drupal 6 to Drupal 8 have a supported window within which to do so. The Drupal core team, key module maintainers, and representatives of the Drupal security team met at Drupalcon Austin to discuss this as an in-person follow up to the previous discussion at https://drupal.org/node/2136029.

Drupal 6 core and modules will transition to unsupported status three months after Drupal 8 is released. "Unsupported status" means the community will not be providing support or patches in the same way we do now. Continuing to support Drupal 6 would be difficult for many reasons, including a lack of automated test coverage, the requirement for rigorous manual release testing, the slow-down it introduces in the release of security fixes for the vast majority of Drupal users (on version 7+), and the general shift of volunteers in the community moving their attention onto Drupal 8 development.

This gives Drupal 6 users a few options:

1) Upgrade to Drupal 7 any time between now and 3 months after Drupal 8.0.0 is released. Drupal 7 releases undergo almost 40,000 automated tests, and Drupal 7 will be fully supported at least until Drupal 9 comes out. Given the past history, the release of Drupal 9 is likely to be around 2018.

2) Upgrade to Drupal 8 after it is released, but before Drupal 6 is not supported anymore. Fortunately, Migrate support for Drupal 6 to Drupal 8 is already in core, and there is Migrate UI, a contributed module. While not all contributed modules will be ready at the time Drupal 8 is released, Drupal 8's migration path handles most of the critical site data via its CCK to Entities/Fields in Core migrations.

3) Find an organization that will provide extended support for Drupal 6. The Drupal Security Team will provide a method for companies and/or individuals to work together in the private security issue queue to continue developing updates, and will provide a reasonable amount of time for companies to provide patches to Drupal 6 security issues that also affect Drupal 7 or Drupal 8. The security team will coordinate access to issues for companies wishing to provide extended support for Drupal 6. However, the team will not explicitly review or test the patches (some team members may do this on their own). All code created by these vendors, would be released to the community.

Organizations and individuals interested in providing this level of support for their customers
AND who have the technical knowledge to maintain a Drupal core release should go to the security team Drupal 6 long term support page.

Both the Security Team and Drupal core leadership feel that a 3-month window after Drupal 8's release before eclipsing community support for Drupal 6 is a workable compromise between leaving Drupal 6 sites on an unsupported version the second Drupal 8 comes out, and acknowledging that our community's volunteer resources are limited and have shifted focus. We hope that organizations that rely on Drupal 6 will step up to help maintain it after community support winds down, and/or help their clients update to D8.

Comments

geerlingguy’s picture

Typo on the first line:

The policy of the community is to drop support only the current and previous stable versions.

I'm all for it, but as D6 has already been playing second fiddle to D7 for a very long time, people with D6 sites need to realize—if you don't have plans to upgrade to D7 or D8 soon, make them now!

__________________
Work: Midwestern Mac, LLC | Personal: jeffgeerling.com

mlhess’s picture

Thanks,

Fixed

Leeteq’s picture

The correct link to the Migrate issue should be:
https://drupal.org/node/2121299

.
--
(A: Recruiting bi-lingual Spanish/English Drupal experts for a global project.
B: Inviting "minipreneurs" and DrupalExpert-wannabees to the same project.)

mlhess’s picture

Thanks,
fixed.

mojomark’s picture

At DrupalCon/Austin, the discussion was that the support would be for 12 months. What changed?

greggles’s picture

As this post points out, the official stance was to discontinue Drupal 6 the very second that Drupal 8.0.0 was released.

There was a proposal to extend the life of Drupal 6 for some time and 12 months had been suggested as a reasonable time frame.

In discussions before and after Drupalcon (including in issues where extending the life of Drupal 6 was proposed) there were concerns expressed around the viability of that idea: i.e. is there enough volunteer capacity to actually do that. In November of 2013 there was a call for more people to volunteer to maintain Drupal 6. That call resulted in 2 people volunteering and while they have done some great work they didn't significantly improve the situation vis-a-vis Drupal 6 support. That's not really surprising since the fundamental problem is that there is no automated test suite for Drupal 6 and there is no interest in manually testing it. So, we're stuck with the position that marking D6 as unsupported at the instant D8 is released doesn't allow for people to upgrade between the two and the reality that D6 is not getting much security support now (and will get less as time goes on and people are even less interested in supporting it). That left us saying "what is the minimum amount of time that we can make the community-based support overlap" and 3 months felt like a good idea.

Note that there are still viable options for getting support. We anticipate that in the months after Drupal 8.0.0 is released that consultants and private companies will advertise services to provide support for Drupal 6. People (such as yourself, perhaps) who want Drupal 6 security patches can consider paying those organizations to do that work. The results of that work will be made available for free somewhere (to be determined) on drupal.org.

--
CARD.com :)

hass’s picture

There is a D6 patch RTBC (https://www.drupal.org/node/1277140) for about 3 years and has never committed or gone into a release. Not sure what 3 additional months will change here if nobody maintains D6 core since ~3 years. This means zero fixes. No idea what 3 additional months will give us.

greggles’s picture

This is only about security issues. Sorry if that was unclear.

--
CARD.com :)

amedjones’s picture

This is good information, I think three months is enough to move forward, I would recommend others to migration to drupal 8 and skip drupal 7.

Regards
Mohammed

i want to be Drupal when I grow up

budda’s picture

Sounds like a risky recommendation if Drupal 8 will only have been out as a fresh 8.0 release for 3 months! (based on previous Core major releases)

greggles’s picture

Each site is different. Upgrading to Drupal 8 or Drupal 7 depends heavily on the code, configuration and organizational needs.

--
CARD.com :)

AhmadZain’s picture

Thanks can we know when the official proaction version of D8 will be released ?

Ahmad M. Zain
Egypt Drupal Founder
TeQniaty CEO & Founder
iahmadzain@gmail.com
Skype: iahmadzain
Twitter: [[http://www.twitter.com/iAhmadZain|@iAhmadZain]]

catch’s picture

It will be released when there are zero critical issues left and there has been successful release candidate.

Currently there are 93 critical issues. Of those, 12 issues have been identified as blocking a beta release.

asb’s picture

An additional three months is nice, but by no means this can be called "Long Term Support" (LTS). And it does not help those who are stuck with D6 because essential modules - like 'image' or certain input formats - still do not provide migration paths to D7.

For example, 'image' module - the one that was used on d.o and has been considered the de-facto standard for images in Drupal for years - still has 46,076 users. Three additional months of security updates for core won't change the fact that those sites will have to start from scratch, or continue to run D6 since in the past five years (!) nobody came up with a solution to migrate stuff like 'image_attach' to anything past D6.

stevetheboater’s picture

The lack of a migration path from image_attach, or indeed anything even half a good in D7 is specifically why I still have a number sites on D6. If D8 is no better in this respect (and I've no reason to expect it will be) I'm not sure what I will do with them. Sadly I don't have coding skills to write a work-around myself and don't have the resources to pay someone to do it for me as these sites are all unpaid voluntary projects.

WorldFallz’s picture

and I've no reason to expect it will be

Then you've neither taken it for a test drive or followed any of the progress. The editor/content creator experience has been one of the major items addressed in d8 and the integration of ckeditor with image handling is light years beyond anything in drupal to date!

_
Don't be a Help Vampire - read and abide the forum guidelines.
If you find my assistance useful, please pay it forward to your fellow drupalers.

KevinVernon’s picture

I think Drupal 8 will be awesome since it is divided into Core initiatives: Mobile, Layouts, Web Services, Configuration Management and HTML5. Thank you for clarifying about D6.

rooby’s picture

This is a semi-related discussion on Drupal 6 and PHP 5.4+, which is becoming more relevant as hosting providers discontinue PHP 5.2 & 5.3 (and those PHP version are no longer supported):
https://www.drupal.org/node/2336585

F.E.M’s picture

The trend should be broken in this case as Drupal 8 is too different from Drupal 7 and so upgrading from 6-> 8 will not be worth it for most site owners with extensive custom code. Drupal 6 is supported on a number of Drupal specific hosting options including Pantheon while currently Drupal 8 is not. All of the best modules on Drupal 6 have not even been ported to Drupal 7, let alone 8, while people (myself included) are actually working on backporting modules to 7 (hey people need it). The "Windows XP" analogy is a good one and could probably even be extended to include Windows 8. I would rather be using an updated version of Windows XP than Windows 8 myself.

F.E.M’s picture

Does it mostly come down to what contributed modules are available? What cases would you say it would be better to upgrade to D6 or to D7?

flashon’s picture

I totally agree with the line of reasoning that led to the 3 month "extension". Unfortunately, I don't think it adequately addresses the use case it is intended to support. The reality for most site owners who will want to migrate from D6 to D8 is that they have a substantial, reasonably feature-rich site on D6. The reason they wouldn't have upgraded to D7 is likely because of custom functionality that made that process too costly for the benefits of moving over to D7. Sites of this scope would normally require at least a handful of contrib/custom modules, and given the learning curve for module developers on D8 I highly doubt that three months will be adequate time to develop the functionality necessary for the typical site people will be wanting to move from D6-D8. I hope I'm wrong.

YesCT’s picture

Issue "[meta] Ensure that Drupal 6 sites have a functional upgrade path to either Drupal 7 or 8 before Drupal 6 loses security support" https://www.drupal.org/node/2030501#comment-9772959 was recently reopened.

Gabrieles’s picture

Hello!

Is there any agency that meets the above requirements willing to provide the patches for D6 after the 3 months grace period has ended? If you do, please do get in touch with me at gabriele.sani at oxfaminternational.org with an estimate of what would be the cost for this service (even a rough one will do. We are evaluating options).

Thank you!