Pantheon release notes

PHP versions 8.3.24 and 8.4.11, and are now available on the platform. These updates brings the latest bug fixes and enhancements, improving performance and security for your sites. Updates will be applied automatically over the next few days, so no manual action is required.

PHP 8.4 is only available with the new PHP Runtime Generation 2. To upgrade your site, set the following in your pantheon.yml file:

The PHP 8.4 upgrade process automatically includes an upgrade to PHP Runtime Generation 2.

Important PHP version information

• PHP 8.1 and 8.2 are currently receiving security-only updates.
• For more details, see the full list of PHP supported versions.

For the best performance and security, Pantheon recommends running PHP 8.2 and above.

Starting August 13th, 2025 Pantheon will start blocking web access to several common configuration and dependency management paths. This is a preventative security measure to protect against potential information disclosure vulnerabilities. For the vast majority of users, no site impact is expected and no action is required.

Key Changes

We are updating our platform's global routing configuration to prevent public access to the following paths:

• composer.json
• composer.lock
• package.json
• phpunit.xml.dist

Any attempt to access these files directly via a web browser or other HTTP client will result in a 403 Forbidden error.

Why make this change?

These files, while essential for development and deployment workflows, can expose sensitive information if they are publicly accessible.

Blocking these files aligns with security best practices by ensuring that information intended for developers and build processes is not publicly exposed.

Site Impact

For most sites, there will be no noticeable impact. These files are not intended to be served publicly, and this change simply enforces security best practices at the platform level.

This change will not affect:

• Your ability to access or modify these files via Git or SFTP.
• Your local development workflow.
• The execution of composer or npm/yarn commands during your build process on Pantheon.

In the unlikely event that your application logic relies on public, web-based access to these files (a practice which is strongly discouraged), please contact support.

Pantheon has deployed a new live chat support experience which unifies our backend infrastructures for Live Chats and Support Tickets.

Key Changes

• Faster support: Combining the backends for tickets and chats means quicker routing and less waiting.
• Improved consistency: Support engineers now have stronger context and continuity for conversations across chat and ticket histories.
• Transcripts: Chat transcripts are no longer available self-serve by the widget, but can be provided upon request.

What to Expect During the Transition

• No interruptions: Users will not experience any interruption in accessing live chat support during this transition.
• Chat history: All chats from the last 30 days prior to the transition will be moved to tickets.

Today we are announcing a new Advanced Global CDN (AGCDN) package that adds Rate Limiting to our Security Starter package. Previously, in order to leverage customized rate limiting capabilities, a higher-tiered AGCDN package was required (Advanced Global CDN with WAF/IO). The Security Starter with Rate Limiting package comes as a response to customer feedback, where rate limiting alone did not justify the requirements (or cost) for the full Advanced Global CDN with WAF/IO package.

To review all available Advanced Global CDN packages and compare available features, see related documentation.

Reach out to your account manager to add AGCDN to your contract. If you don't have an account manager, you can contact sales.

All WordPress plugins and Drupal modules actively maintained by Pantheon have been confirmed to be compatible with PHP 8.4. Most did not require any code updates to be compatible, so they did not receive a version bump.

• Pantheon Advanced Page Cache (WordPress)
• Pantheon WordPress mu-plugin
• WP Redis
• WP Native PHP Sessions
• WP SAML Auth
• Pantheon HUD
• Search API Pantheon
• Pantheon Advanced Page Cache (Drupal)
• Pantheon Content Publisher (Drupal)

PHP 8.4 is now available on the Pantheon platform. Learn more about the release.

Editorial note: The date has been moved from October 21 to December 2.

As part of our ongoing platform maintenance and security improvements, sites on the platform running Drupal 8.0-9.3 will no longer be able to access Pantheon Search services (Apache Solr-based search) starting December 2, 2025.

After this date, affected sites will not be able to fetch Solr search results or index new content. Views or blocks that rely on Solr-powered Search API indexes may fail to load, return no results, or throw errors.

Drupal 8 reached end-of-life (EOL) in November 2021 and Drupal 9 in November 2023. EOL software does not receive security or feature updates, and could expose sites to attack if any vulnerabilities or exploits are discovered.

To find out which version of Drupal your site is running, go to your site in the Pantheon Dashboard > Status then look for the Drupal value in the Status block, or use the Terminus CLI command terminus drush <site>.<env> status.

Action Required

Affected Drupal 8.0-9.3 sites will need to be upgraded to Drupal 9.4+, Solr 8, and search_api_pantheon 8.2+. Drupal core and Solr upgrade guides are available in our documentation.

Alternatively, Pantheon Search can be disabled and site owners may choose to implement Drupal’s built-in database search or another alternative such as a third-party search service provider.

We have released version 3.0.0 of the Pantheon WP Coding Standards. This is a major release over the previous 2.x versions which adds new sniffs for use of the PHP rename() function, which is not supported on Pantheon, and commenting. Upgrading to this version may cause some existing code to fail the new sniffs, so we recommend reviewing the release notes.

The Pantheon WP Coding Standards are a set of custom rules for PHP_CodeSniffer that help developers write maintainable code that is compatible with Pantheon’s platform. They are not used by default in Pantheon’s WordPress sites, but can be installed and configured to run in your local development environment or CI/CD pipelines and are actively used by the WordPress plugins that Pantheon maintains.

For a full list of changes in this release, please refer to the 3.0.0 release notes. Learn more about our Pantheon WP Coding Standard in our video on YouTube.

The latest version of WordPress, 6.8.2, is available on Pantheon as of July 15, 2025.

Action required

Upgrade to WordPress 6.8.2 right from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

• 35 bugs throughout Core and the Block Editor.

• The release announcement mentions that security updates will no longer be provided for WordPress 4.1-4.6.

For full details about WordPress 6.8.2, see the official release announcement.