With the recent announcement from D.O. about the change in End Of Life plans for Drupal 7 I believe a discussion on ending support for the 7.x branches prior to the D7 EOL needs to be held.
As only a co-maintainer I do not believe I have ability to make a binding judgment on this subject unless no maintainers respond at all. I am placing this issue for public feedback and to provide a location for other maintainers to comment.
Background
When I first volunteered to assist in maintaining this module in early 2021 I joined on solely for the D8 and beyond branches. I was advised another developer had just come onboard to maintain the 7.x branches and I assumed I would not have to worry about any D7 support.
Status of the 7.x branches
- No maintainer or community member has to my knowledge been working through the existing issues to triage and resolve them.
- The code has not be modified in over a year.
- Amazon is not actively maintaining version 2 of the PHP SDK used by the 7.x-2.x branch
- S3fs is a security covered module.
Going forward
- The D8+ release is essential stable. A few minor patches have shown up since the last beta and D10 support looks promising in local testing.
- We now have no knowledge of when D7 will actually go EOL, it could be indefinitely.
Proposal
- Mark the D7 branches unsupported.
- Allow a period of time to see if a new maintainer volunteers for both the D7 branches
- If no new maintainer volunteers after 90 days begin triaging issues to be continued in the 8.x branch if relevant or closed (outdated). Possible add a tag so the triaged issues can be recalled in future if for some reason they are needed again.
Justification
I had planned to raise an issue in a few months about how we will handle making the branch unsupported at the same time as Drupal however I can no longer follow that plan.
Because s3fs is a security supported module, issues in the 7.x branch could lead to issues for the 8.x branch. I can not guarantee I have enough D7 knowledge to fix a security issue on the D7 branch if one were to arise. Perhaps one of the other maintainers on the project could step up in that case, however if that maintainer is not routinely actively involved I'm not sure we have any good way to know they will be able to do so.
Additionally an issue queue full of issues that have not even been triaged may be painting a negative light on the the module limiting adoption. I'm not sure how clear it is that the D8 branch is under active work while D7 is not.
I do not make this suggestion without knowledge that it could have a major impact on users.
https://www.drupal.org/project/usage/s3fs β
shows that approximately 40% of the user count is on the D7 branches. Even if a new maintainer signs up from this we will have caused a fair amount of shock to administrators.
I believe this level of shock should be justifiable though in that the module going unsupported for security reasons would be far more impactful to everyone. Additionally we have already passed the November 2021 original D7 EOL when administrators should have originally transitioned away from D7.