Problem/Motivation
According to http://symfony.com/roadmap?version=2.7#checker symfony will ship security updates for 2.x until may 2019.
Unless magic happens D10 won't be out at that time.
How do we handle that problem
Proposed resolution
- Drupal 8.0.0 will use Symfony 2.7.
- As soon as Symfony 2.7 beta is released in February 2015, we will incorporate it into the Drupal 8 beta.
- We will continue to incorporate additional Symfony 2.7 beta releases and then the Symfony 2.7 production release (and future Symfony 2.7.x releases) into Drupal 8.0.x releases, both beta and production.
- Going forward, starting now, we should start to try to avoid using deprecated methods in Symfony 3.0. In particular, in order to prepare Drupal for Symfony 3.0, we should start to make our Drupal code more compatible today by taking the suggestion of the Symfony folks and make the optional suggested changes that are discussed at:
Upgrade Guide for Symfony 3.0 - We should have a running issue where we can upload patches to upgrade to 3.x and see what breaks. While we very likely will not ever commit those to 8.0.x, it allows us to file upstream bug reports or fix compatibility issues quicker.
- Once 8.1.x is branched, we can consider running that on the Symfony 3.x branch as one of the changes - assuming the timing is right to hit 3.0.x with 8.1.0. However, that would require us to upgrade the minimum PHP requirement for Drupal 8.1.x (due to Symfony 3.x dropping PHP 5.4 support), and we can can consider any implications of that at that time, including hosting/distro support.
- If we decide not to do it for 8.1.x, we can consider again for 8.2.x, 8.3.x, etc., but we must update to Symfony 3.x before Drupal 8 LTS.
Remaining tasks
Agree, document.
User interface changes
N/A
API changes
Avoid using deprecated methods in Symfony 3.0.
API changes to Symfony 3.0 so far: https://github.com/symfony/symfony/blob/master/UPGRADE-3.0.md (few if any of these affect us)
Possible API changes summarized: https://github.com/symfony/symfony/issues/11742 (main change would be sessions, but session handling is still being finalized for 8.x so that might be a good change if we can get it early enough).