What changes are there for third-party dependencies?

Drupal 8 depends on various backend and frontend libraries. Our approach to implementing dependency updates is making Drupal 8 as compatible as possible with these updated versions. This allows sites to test with these updated dependencies, but the required dependency versions remain intact so backwards compatibility is ensured. Drupal has various dependencies and this list may not be exhaustive. Most of Drupal 9's significant dependency updates are listed in the Drupal 9.0.0-beta1 release notes.

Symfony 3 to 4.4

Drupal 9's release date is planned to ensure security support for our most important third party dependency, Symfony. Since Symfony 3 will be end-of-life in November 2021, Drupal 9 is updated to Symfony 4.4. While Symfony 5 is now available, the disruption of jumping from Symfony 3 to 5 was too great for Drupal 9's release; however, we will try to ensure Drupal 9 is as forward-compatible with Symfony 5 as possible.

Twig 1 to 2

Drupal 8 depends on Twig 1. While there is no clear end of life date published yet, Twig 2 has been released for years. Drupal 8.7.0 was released with optional support for Twig 2 and Drupal 9 will depend on Twig 2.

CKEditor 4 (not 5)

CKEditor 4 and 5 are two entirely different codebases. Drupal 8 and 9 both include CKEditor 4. Security support for that version will end around the time of Drupal 9's end-of-life. Therefore, Our plan is to include CKEditor 5 in a future version of Drupal 9, deprecate CKEditor 4 in Drupal 9 and remove it in Drupal 10. This longer deprecation timeframe is due to the new architecture of CKEditor 5, as that will necessitate some work for modules that integrate with it.

jQuery and jQuery UI

We re-evaluated our dependency on jQuery UI and are removing most components from core since it is an "Emeritus Project" (end-of-life). A limited number of components will remain as forked versions that can be patched for any security issues. Drupal 9 will still depend on jQuery itself.

PHPUnit

Drupal 8 deprecated our own SimpleTest testing system in favor of the well-known PHPUnit. Drupal 9 requires PHPUnit 8 and work has been done to add a forward-compatibility layer for PHPUnit 9. PHPUnit updates their PHP requirements strictly according to the support provided by PHP, which may be faster than some production sites can update their requirements. For this reason, we may have to further update Drupal 9's PHPUnit compatibility after 9.0.0's release.

Doctrine

Drupal 8 uses Doctrine's Simple Annotation Parser, but that has been deprecated and will be removed from a future release without a replacement. We forked the part of the code we needed and included it with Drupal core.

Other dependencies

There are other dependencies updated on the frontend and backend alike. The above are the most important ones. A more complete list will be available in the 9.0.0 release notes.