Pantheon release notes

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.105 is now available with a critical security patch.

In order to swiftly provide security coverage for a discovered vulnerability, both 7.104 and 7.105 have been included in a 7.105 tag for the drops-7 upstream.

• 7.104: This backports a prototype pollution fix in the BBQ JavaScript library used by several popular modules, including Views, Overlay and Module Filter. Of the usages inspected, only Overlay was found to be using BBQ in a vulnerable manner. If you cannot upgrade immediately, the issue can be mitigated by uninstalling Overlay module. If Overlay is not installed, then this update is not needed.

• 7.105: This adds support for PHP 8.4. If you do not run and/or do not plan to run your site on PHP 8.4, you do not need this update. Because of the many deprecation notices added to PHP 8.4, it is recommended that ini_set('error_reporting', E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED) or some equivalent is added to the site's settings.php file.

Action required

Apply the latest upstream update to your Drupal 7 site to receive these updates. See related documentation for how to apply core updates.

About Drupal 7 Long-Term Support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites until at least January 5, 2027. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

The latest version of WordPress, 6.8.3, is available on Pantheon as of September 30, 2025.

Action required

Upgrade to WordPress 6.8.3 right from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

• This is a security release - immediately update your websites
• Resolved security issues include a data exposure risk for authenticated users and an authenticated user role XSS vulnerability in navigation menus

For full details about WordPress 6.8.3, see the official release announcement.

PHP Runtime Generation 2 includes updated extensions, PHP 8.4 availability, and enhanced security features. This new PHP runtime is currently rolling out to existing sites on the platform.

We continue to encourage customers to upgrade to Generation 2 proactively, or manually opt-out if you need more time.

Rollout Timeline

The upgrade rollout will take place over the next 60¹ days. For granular timeline details², see related documentation.

Editorial note:

¹ This has been revised from 40 to 60 days

² Timeline has been relocated out of release notes into related documentation

How to determine which PHP runtime your site environment is using

The PHP Runtime is set at the environment-level. You can find out which generation an environment is using via Terminus:

• Terminus 4.0.2+: Use the command terminus env:info <site>.<env>

Pantheon has released a new version of our Native PHP Sessions plugin. This release updates documentation and a number of minor dependencies under the hood. Most notably, this update tests the plugin against PHP 8.4, increases the minimum PHP version to 7.4 and bumps the minimum supported WordPress version to 5.3. Additionally, to comply with WordPress plugin repository guidelines, we have removed "WordPress" from the plugin name.

Action required

You are encouraged to upgrade your version of Native PHP Sessions to the latest version as soon as you are able.

If you have issues with the plugin, please use the GitHub issue queue for the plugin.

New sites created on the platform now use PHP Runtime Generation 2.

PHP Runtime Generation 2 includes updated extensions, PHP 8.4 availability, and enhanced security features. This new PHP runtime will begin rolling out to existing sites on September 24.

Some PHP extensions and OS packages have not been ported over to Generation 2 yet, and may never be ported. Review the OS Packages and PHP Extensions documentation to review these changes. If your new sites depend on these, we recommend you downgrade to Generation 1 and contact your Customer Success Manager or create a support ticket to discuss your site needs.

Today, Pantheon's Content Publisher moves from Beta to Public Preview. In Beta, teams needed to request access to use Content Publisher. Now any team with a Google Workspace can sign up to use Content Publisher to publish to their website straight from Google Docs, with a free 30-day trial of our enterprise-level plan.

If you wish to use Content Publisher with your WordPress, Drupal, or Next.js sites, sign up here.

This promotion to Public Preview also reflects increased product maturity in areas like:

• Pricing information and free trial of enterprise-level features now publicly available.
• New releases for our Drupal module and WordPress plugin with bug fixes and feature improvements.
• Multiple Google Workspaces can now be connected to a single Content Publisher account.
• Content approval workflows that allow content editors to submit content to be approved and published by administrators.
• Live chat support now directly integrated within the Content Dashboard interface.

For more perspective on Content Publisher, check out the announcement blog post. See our documentation site for guidance on using Content Publisher.

Share feedback – We have a dedicated Slack channel for public preview participants where you can easily ask questions and discuss feedback with the Pantheon product and engineering team. To request an invite, submit this form.

Terminus 4.0.3 is now available. This small update contains the latest bug fixes and improvements for this tool.

Added

• Make site label available in site:list and org:site:list commands
• Add a debug log message to workflow:wait printing the workflow start time

Fixed

• Regression affecting SSH commands (e.g., drush, wp-cli) on sites using external version control
• Un-deprecated --tags parameter on org:site:list command
• Remove unnecessary api call from tag:add and tag:list causing unnecessary load and timeouts

How to upgrade Terminus

If you manage your installation via Homebrew on macOS, you can update Terminus with the following command:

For other systems, see additional upgrade instructions here.

PHP versions 8.3.25 and 8.4.12, and are now available on the platform. These updates brings the latest bug fixes, improving performance and security for your sites. Updates will be applied automatically over the next few days, so no manual action is required.

PHP 8.4 is only available with the new PHP Runtime Generation 2. To upgrade your site, set the following in your pantheon.yml file:

The PHP 8.4 upgrade process automatically includes an upgrade to PHP Runtime Generation 2.

Important PHP version information

• PHP 8.1 and 8.2 are currently receiving security-only updates.
• For more details, see the full list of PHP supported versions.

For the best performance and security, Pantheon recommends running PHP 8.2 and above.