Pantheon release notes

Terminus 4.1.0 is now available. This minor update contains the latest bug fixes and improvements for this tool.

This release includes enhanced environment information visibility and improved error messaging.

Added

• PHP Runtime Generation and PHP Version fields are now optional fields of the env:list command output, providing better visibility into your environment's PHP configuration
  • Use env:list <site> --fields=id,php_runtime_generation,php_version to view these fields

Fixed

• Improved workflow timeout handling now displays warnings instead of confusing error messages when workflows take longer than expected

How to upgrade Terminus

If you manage your installation via Homebrew on macOS, you can update Terminus with the following command:

For other systems, see additional upgrade instructions here.

PHP versions 8.3.26 and 8.4.13, are now available on the platform. These updates bring the latest bug fixes, improving performance and security for your sites. Updates will be applied automatically over the next few days, so no manual action is required.

PHP 8.4 is only available with the new PHP Runtime Generation 2. To upgrade your site, set the following in your pantheon.yml file:

The PHP 8.4 upgrade process automatically includes an upgrade to PHP Runtime Generation 2.

Important PHP version information

• PHP 8.1 and 8.2 are currently receiving security-only updates.
• For more details, see the full list of PHP supported versions.

For the best performance and security, Pantheon recommends running PHP 8.2 and above.

Starting today, the session length for users logged into the Pantheon Dashboard has been reduced from 24 hours to 14 hours - regardless of session activity.

Key Changes

• Previously, Pantheon Dashboard sessions expired after 24 hours of inactivity.
• Previously, session lengths were inconsistent in some places of the Pantheon Dashboard leading to random logout and authentication requests.
• Reducing session lengths to 14 hours across the Pantheon Dashboard provides various security benefits and stronger protection for your accounts.

Terminus sessions are not impacted. See related documentation for more information.

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.105 is now available with a critical security patch.

In order to swiftly provide security coverage for a discovered vulnerability, both 7.104 and 7.105 have been included in a 7.105 tag for the drops-7 upstream.

• 7.104: This backports a prototype pollution fix in the BBQ JavaScript library used by several popular modules, including Views, Overlay and Module Filter. Of the usages inspected, only Overlay was found to be using BBQ in a vulnerable manner. If you cannot upgrade immediately, the issue can be mitigated by uninstalling Overlay module. If Overlay is not installed, then this update is not needed.

• 7.105: This adds support for PHP 8.4. If you do not run and/or do not plan to run your site on PHP 8.4, you do not need this update. Because of the many deprecation notices added to PHP 8.4, it is recommended that ini_set('error_reporting', E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED) or some equivalent is added to the site's settings.php file.

Action required

Apply the latest upstream update to your Drupal 7 site to receive these updates. See related documentation for how to apply core updates.

About Drupal 7 Long-Term Support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites until at least January 5, 2027. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

The latest version of WordPress, 6.8.3, is available on Pantheon as of September 30, 2025.

Action required

Upgrade to WordPress 6.8.3 right from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

• This is a security release - immediately update your websites
• Resolved security issues include a data exposure risk for authenticated users and an authenticated user role XSS vulnerability in navigation menus

For full details about WordPress 6.8.3, see the official release announcement.

PHP Runtime Generation 2 includes updated extensions, PHP 8.4 availability, and enhanced security features. This new PHP runtime is currently rolling out to existing sites on the platform.

We continue to encourage customers to upgrade to Generation 2 proactively, or manually opt-out if you need more time.

Rollout Timeline

The upgrade rollout will take place over the next 60¹ days. For granular timeline details², see related documentation.

Editorial note:

¹ This has been revised from 40 to 60 days

² Timeline has been relocated out of release notes into related documentation

How to determine which PHP runtime your site environment is using

The PHP Runtime is set at the environment-level. You can find out which generation an environment is using via Terminus:

• Terminus 4.0.2+: Use the command terminus env:info <site>.<env>

Pantheon has released a new version of our Native PHP Sessions plugin. This release updates documentation and a number of minor dependencies under the hood. Most notably, this update tests the plugin against PHP 8.4, increases the minimum PHP version to 7.4 and bumps the minimum supported WordPress version to 5.3. Additionally, to comply with WordPress plugin repository guidelines, we have removed "WordPress" from the plugin name.

Action required

You are encouraged to upgrade your version of Native PHP Sessions to the latest version as soon as you are able.

If you have issues with the plugin, please use the GitHub issue queue for the plugin.

New sites created on the platform now use PHP Runtime Generation 2.

PHP Runtime Generation 2 includes updated extensions, PHP 8.4 availability, and enhanced security features. This new PHP runtime will begin rolling out to existing sites on September 24.

Some PHP extensions and OS packages have not been ported over to Generation 2 yet, and may never be ported. Review the OS Packages and PHP Extensions documentation to review these changes. If your new sites depend on these, we recommend you downgrade to Generation 1 and contact your Customer Success Manager or create a support ticket to discuss your site needs.