Will Drupal 6 be left in a secure state after it becomes unsupported?

Question

I created a custom database interface using Drupal 6 + Views + CCK that works really well for my company and recently I had to migrate it to another server.

I thought "Hey, why not install Drupal 7 and then dump the database in it: then I can upgrade Drupal to the latest version while we migrate!?"

That turned out to be a bad idea. Drupal 7 doesn't seem to have the slightest clue what to do with the DB info I gave it. And the upgrade guide looks very time consuming to me, right now.

So my question is: will Drupal 6 be left in a secure state after it becomes unsupported? Or will the platform become deprecated and vulnerable forcing an even more massive upgrade on me?

Answer 1

I think until some of the major contributed modules like Views have Drupal7 modules that are stable and not alpha, beta I think drupal6 will be used for some time to come.

I'm certain that drupal6 will be supported for years to come as there are A LOT of drupal6 sites out there.

So the answer is No you don't HAVE to upgrade.

Answer 2

Once Drupal 8 comes out, Drupal 6 will be marked "end of life": the Drupal security team will stop working on it and official security releases won't come out for it. If any new vulnerabilities come out, you'll have to patch it yourself. So it's really in your benefit to upgrade at that point.

But upgrade paths for Drupal are from the previous version to the current version: that is, an upgrade path is provided from the last release of Drupal 6 to Drupal 7, and an upgrade path will be provided from Drupal 7 to Drupal 8.

There won't be an upgrade path for Drupal 6 to Drupal 8: if you don't want to rebuild your site from scratch when Drupal 8 comes out, you'll need to first upgrade your Drupal 6 site to Drupal 7, then upgrade to Drupal 8.

So, it really comes down to economics and long term planning. Drupal 6 will be supported until Drupal 8, but when Drupal 8 comes out in a couple of years, will you have an opportunity to rewrite the site? If not, you should plan to upgrade to Drupal 7 at some point in the future.

Answer 3

There are always 2 versions of Drupal supported at the same time. So when Drupal 8 will be released, Drupal 6 will become unsupported. There is some time left until that will happen, so you don't have to hurry.

If enough people are willing to continue patching security bugs, you might continue to use it safely even if it is not officially supported anymore. Anyone that wants to can continue to support Drupal 6 with security patches indefinitely, the question is whether enough people are interested in doing that. I would not count on Drupal 6 being still supported after the official release of Drupal 8.

Answer 4

Your original problem is that you don't want to spend massive amount of time upgrading your site - I can understand this well, but I would definitely recommend to do the upgrade. A couple of reasons:

• Sooner or later you will have to upgrade because Drupal 6's is nearing end of life.
• If you're working with Drupal sites, you'll benefit greatly if you learn how to do a major upgrade. Many people like me started with Drupal 6, so this is the first upgrade that we should be able to apply - it's valuable knowledge.
• You can "alter" the upgrade process written in the Handbook - nobody mentioned that you should do that on one afternoon, for example... If I were you, I would spend several hours with preparations, checking modules and themes, checking the core etc. and on the next day I would proceed with the upgrade in a test environment. This way you can have a little more comfort. The main thing is, take notes of everything. It's better to have each click documented (which would be crazy) than to have nothing written down. Try to enjoy doing this, the upgraded site will be better than ever!

And remember, we have a huge community with a lot of energy and support, so talk about what you do, write a blog post or something - someone will benefit from it greatly, perhaps even you.

Answer 5

About 5 years after this question was asked, here is another answer based on what we know today ...

Will Drupal 6 be left in a secure state, come the day that it is unsupported?

Drupal 6 has been announced to be end of life as of Feb 24, 2016, as detailed in Drupal 6 end-of-life announcement (*). So unless you take some appropriate actions, sites that will still be using Drupal 6 after that date are at risk of becoming insecure.

However, in the meantime the myDropWizard module has been released ... for D6 ... still, and only !!!. Refer to "How to get accurate information about available security updates after End-of-Life?" for more details on that.

Or will the platform become deprecated and vulnerable forcing an even more massive upgrade on me?

For situations where "upgrading a D6 site isn't an option", a possible alternative is to Buy Drupal 6 Long-Term Support (LTS) from one of the “official” vendors. Moreover, there seems to be the D6LTS project. For more details on that, refer to the answer to How to proceed with a D6 site after Feb 24, 2016 when D6 is end of life?.

For those who wonder "How many reported Drupal 6 installs do we have left?", go check the Usage statistics for Drupal core (about D5, D6, D7, D8)... As of Jan 31, 2016, there seem to "only" be about 110K sites left (as compared to about 1046K for D7, and 64K for D8). That's about 40K less as compared to a year ago (at that rate it'll take another 3 to 4 years ...).

(*): this link also contains a lot of interesting comments, such as the very first comment below it, which is like so:

By definition, a release on a project page is supported when two conditions exist:

1. the project maintainer believes it to be supported.
2. the security team is accepting reports of security issues and making advisories about it.

That's what "supported" status means and has meant since May of 2009 (and reiterated in May of 2010).

That is why item 4 is in this list:

All Drupal 6 releases on project pages will be flagged as not supported.

As of the Drupal 6 EOL, item #2 will no longer be true so it makes sense to mark them as unsupported.

This post about the EOL is the result of numerous conversations over the past 3 years about when the EOL should be. People who want Drupal 6 and/or contributed modules to be supported longer.

Answer 6

When a new Drupal version comes out, there is no attempt to make new builds "backward compatible" with old ones. Some fundamental things changed with Drupal 7, including the fact that what was the "CCK" module is now a feature in the core functionality of Drupal. So a Drupal 7 install won't know what to do with a Drupal 6 database, unless you follow the recommended upgrade procedure. (And even then, if you've customized any modules or written your own modules or templates, you will have some work to do to fully convert the application over.)

That said, no, you don't have to upgrade, at least not now. You are fine sticking with Drupal 6 up until Drupal 8 comes out, as others have pointed out. You could run a parallel Drupal 7 server on a MAMP or WAMP install on your own hard drive, and use it to practice porting your application to Drupal 7. Once Drupal 8 comes out, you should be ready to upgrade your application to Drupal 7 (and any other modules you've installed should have caught up with D7 by then).