What and why is this happening?
When this happens Drupal 8, and all Drupal 8 community contributed modules, will no longer be updated. This includes security updates. For sites to remain secure, they must upgrade to use Drupal 9 beforehand.
Time left until Drupal 8 is shelved
Like any modern software package, Drupal is built on top of several other code libraries, which are known as the project’s “dependencies”. The largest of these dependencies is the Symfony PHP framework. Drupal 8 uses Version 3 of this framework and that is scheduled for end of life in November this year, forcing Drupal to move to Symfony version 4. This move requires large portions of Drupal to be re-written to accommodate it, creating the Drupal 9 release and triggering the end of Drupal 8.
How easy is it to upgrade?
Upgrading from Drupal 8 to Drupal 9 has been advertised by the Drupal Steering Committee as relatively pain-free, with the same level of complexity as upgrading from Drupal 8.7 to 8.8. Typically, this would be around half a day's work.
Now that Drupal 9 has been out long enough to be considered stable and production-ready, we've updated some of our client sites from Drupal 8 to 9. For example, Warrington & Co and the Warrington Business Exchange. What we've found is that whilst upgrading Drupal's Core is indeed relatively simple, the issue lies with the dozens of 3rd party modules a typical Drupal website has.
All these modules must be upgraded to a Drupal 9 compatible version. Whilst any given module may routinely be updated to a later version over the course of a website's life, there is no particular need to do so unless a security release is published, or specific functionality from a newer version is required. Updating modules requires testing and, when they break, remediation. It is normal for the majority of 3rd party modules in a site to not be upgraded for significant periods of time. This means to upgrade to Drupal 9 a large percentage of a site's community modules will require upgrading and testing. This can be an unavoidably time-intensive process due to the sheer number of modules involved. And of course, there are some modules that have no Drupal 9 compatible version.
How much work will my site need to be Drupal 9 ready?
To assess Drupal 9 readiness, a module called Upgrade Status has been created by the Drupal community. This module scans your site and tells you what work would be needed before your site is fully compatible with Drupal 9. Its results are divided into the following sections:
Drupal core and hosting environment
The first section checks the compatibility of your core dependencies.
The "Remove" section lists modules not in use. There are reasons why a module would be disabled for the short-term, but if it's something that's been replaced or made redundant, then this could be a good opportunity to do some housekeeping.
The "Update" section lists modules that aren't already at their latest versions. The scan results also tell you if the current version is Drupal 9 compatible.
The "Scan" section lists modules the scanner can find no information on. These are usually custom modules you or your web agency of choice have expressly built for your site. These modules may require some manual alterations before they are Drupal 9 compatible.
However, the task may not be as daunting as it first appears. Typically, if only 1 problem is reported, it will be referring to a line of code that tells the website what version of Drupal the module is compatible with. Expanding this from "Drupal 8" to include "Drupal 9" will fix the issue.
Collaborate with maintainers
The "Collaborate with maintainers" section lists modules that the scanner can find information on, but have no Drupal 9 version listed. This does not necessarily mean the modules are now obsolete. Very frequently, you can find patches and updates contributed by other developers on the module's page of reported issues.
Drupal 9 compatible
And finally, we have the "Drupal 9 compatible" section that lists modules that are already Drupal 9 compatible.
How long will all this take to fix?
It is rare that we run into a module that is irreparably broken or doesn't have an alternative available to replace it. The biggest time-consumer is cross-checking all the modules to make sure that minor updates don't cause conflicts or bugs. As a ballpark figure, we spend roughly one to one-and-a-half hours per module. Updating a core dependency can take longer.
To give you an idea of billable hours, a large site of 60 to 80 modules would take approximately 15 workdays to fully upgrade to Drupal 9, whilst a small site of a dozen or so modules would take around 5 workdays.
It should be pointed out that these estimates are based on a site that follows best practices. One of the changes to Drupal 9 is that it must use Composer. Composer is a piece of software that manages the installation and downloading of Drupal modules. It has long been a standard bit of kit that all professionally-made sites use. If a site has been running a long time without any changes or has been restricted to a lower budget, you may be dreading pulling up the carpet and seeing what's underneath, but now's as good a time as any. Upgrading to Drupal 9 will ensure your site is secure, future-proofed, and has access to the latest features.
We'd be happy to create a quote for the upgrade of your Drupal 8 site to Drupal 9, so you know exactly where you stand. To kick things off, please email us at email@example.com with a brief introduction to your organisation and your Drupal site. One piece of advice we would definitely give is to not leave the upgrade process to the last minute, as many site owners are likely to be rushing to move to Drupal 9 before Drupal 8 becomes insecure after the 2nd November this year!