I have a custom module that I think requires Drupal 8.6.x.
Is Drupal core 8.6.18 insecure? Will more 8.6.x versions be released?
-
5TL,DR: 1) Yes. 2) No. For maintenance schedule see drupal.org/core/release-cycle-overview and for security advisories see drupal.org/security and– HudriCommented Dec 31, 2019 at 15:24
-
Thanks guys, I took the affected website offline. But, can someone explain to me what is "opinion-based" about this question and it was closed? There is a red banner displayed in Drupal that 8.6.18 has security problems (sounds like a fact to me). I could invest time now to update the problematic module, but a replacement website is already in the starting blocks without Drupal. :P– qräbnöCommented Jan 1, 2020 at 13:55
-
1Actually, this is not an opinion-based question: It's possible to say if Drupal 8.6.x is secure by looking at the 8.7.x, 8.8.x, or 8.9.x versions released because of security issues. There isn't anything subjective in that. While the question is asking about the 8.6.18 version, the answer is still relevant for future versions, since it points out the release cycle is documented.– avpaderno ♦Commented Jan 11, 2020 at 12:51
Add a comment
|
1 Answer
According to the Drupal core release cycle documentation, the last month for security coverage for 8.6 was November 2019. There is no more planned security coverage for 8.6.
Security releases only last through the next minor release cycle. I.e. 1.0 will receive patch and security releases until 1.1 is released. Then 1.0 will continue to receive security coverage until 1.2 is released. Once 1.2 is released (the second minor release since 1.0), 1.0 is considered unsupported.
