In the course of the Drupal 6 end of life process we discovered that Update status did not gracefully handle end of life for core or contrib. Similar issues will likely also affect Drupal 7 (and eventually Drupal 8 and beyond).

  • Marking the project as unsupported meant that users on prior versions would not be prompted to update to the latest release, even though we wanted all remaining D6 users to at the very least update to the last version to receive security updates.
  • Marking projects as insecure did prompt users to update to the latest versions, but mangled the intended messaging to inform users that D6 core and these projects would no longer be supported going forward.
  • Furthermore - there was no easy way to direct D6 site owners to End of Life information and the long term support program option.

Ultimately we've hacked around the problem by changing the xml we serve to Update status from the Drupal.org side (see #2675892: Drupal 6.38 isn't correct in Update Status, it is unsupported and will be insecure in the long run, but this was obviously non-ideal.

Though D7 end of life is still quite a ways away (and D8 even further) it would be good to address this before we run into it again.

There are a few key areas to think about for D7 and D8 updates, when it comes time for EoL:

  • Unsupported should likely be changed to continue to prompt updates to the latest release
  • We should consider adding an End of Life status for both core and contrib projects- that allows us to push additional messaging such as links to EOL information on Drupal.org
  • We should consider including a global message area on the Updates section that could be served from Drupal.org
  • (maybe) We should consider whether we should support LTS vendors directly with update.module as canonical sources for update information after EOL

Comments

hestenet created an issue. See original summary.

hestenet’s picture