Pantheon release notes

PHP version 8.3.22 is now available on the platform. This update brings the latest bug fixes and enhancements, improving performance and security for your sites. Updates will be applied automatically over the next few days, so no manual action is required.

Important PHP version information

• PHP 8.1 and 8.2 are currently receiving security-only updates.
• For more details, see the full list of PHP supported versions.

For the best performance and security, Pantheon recommends running PHP 8.2 and above.

Pantheon has released a new version of our WP SAML Auth WordPress plugin. This release adds a notification for a recently discovered vulnerability in the SimpleSAMLphp library that can expose sites to SSO (Single Sign-On) forgery or impersonation.

This vulnerability affects only a small minority of WP SAML Auth implementations because the plugin defaults to a more modern library, OneLogin PHP SAML. Only sites configured with an outdated version of the SimpleSAMLphp library are vulnerable.

The update to WP SAML Auth includes a warning message displayed in the WordPress admin if a vulnerable version of SimpleSAMLphp is detected with instructions to install SimpleSAMLphp 2.3.7 or higher. Since the migration from the previous and most vulnerable versions of SimpleSAMLphp (1.x) to a newer and more secure version (2.x or above) can be onerous, some teams may prefer to switch from SimpleSAMLphp to the default of the plugin, OneLogin PHP SAML than to upgrade SimpleSAMLphp.

When a version of SimpleSAMLphp older than 2.0.0 is detected, an error notice is displayed in the WordPress admin on every page. An option has been added that can be used to disable SAML-based authentication entirely if the version of the library is in this critical state. When a version of SimpleSAMLphp older than 2.3.7 is detected, that notice is downgraded to a warning, but is still visible across all admin pages until SimpleSAMLphp has been upgraded. If the version could not be detected, a warning message appears on the WP SAML Auth admin page.

Action required

You are encouraged to upgrade your version of WP SAML Auth to the latest version as soon as possible so you know with certainty whether your site is vulnerable. If you see the notice in your dashboard, we recommend that you upgrade to the latest version of SimpleSAMLphp immediately.

If you have questions or concerns, please open issues in the queue for the plugin.

As part of our ongoing platform maintenance and security improvements, Drush versions 5 and 7 are no longer available on Pantheon. Sites currently configured to use Drush 5 or 7 are being automatically upgraded to Drush 8 over the next few days.

Drush 5 reached end-of-life (EOL) in May 2015 and Drush 7 in July 2017. EOL software does not receive security or feature updates, and could expose sites to attack if any vulnerabilities or exploits are discovered.

Find out which version of Drush your site is running.

Action required

While all sites previously using Drush 5 or 7 have been auto-upgraded to Drush 8, the pantheon.yml file for these sites have not been changed and will still contain the retired values. In the future, this will cause a git push to the platform to be rejected. Customers with sites configured for Drush 5 or 7 should upgrade the Drush version in pantheon.yml to at least Drush 8.

Sites created with custom upstreams using EOL Drush versions may also have unexpected behavior upon site creation. Upstream updates may also fail if pantheon.yml is updated while drush_version is still set to 5 or 7.

Starting today, PHP versions less than 5.6 in pantheon.yml will be rejected by the platform on git push.

Earlier this year, PHP versions 5.3 and 5.5 reached end-of-life on the platform. While sites configured to use these PHP versions have already been auto-upgraded to use PHP 5.6, the old values have still been allowed in the pantheon.yml file.

Applying upstream updates on a site configured with an EoL PHP version may fail too. The workflow logs will report when that failure is due to the PHP version being rejected. Sites created with custom upstreams using EoL PHP versions may also see failed workflows.

Action Required

Customers with sites configured for PHP 5.3 or 5.5 should upgrade the PHP version in pantheon.yml to at least PHP 5.6.

Pantheon currently recommends at least PHP 8.1 for all production sites.

A followup update to last week's release for the Drupal 7 pantheon_apachesolr module is now available for the Drupal 7 upstream.

This update resolves a regression with local development in version 1.1 of pantheon_apachesolr.

As a reminder, customers using Solr with Drupal 7 sites should update their sites to the latest version of the upstream as soon as possible. Customers with custom upstreams will need to update their upstreams to include the last changes in the platform upstream.

Starting June 17, 2025, Pantheon will require the updated Pantheon Apache Solr module (provided in the Pantheon Drupal 7 upstream) for Drupal 7 sites to access Solr services. Sites running on older versions of the Drupal 7 upstream (with pantheon_apachesolr version 7.x-1.0 or below) will no longer be able to access Pantheon's Solr services.

Terminus 4.0.1 is now available as of May 19, 2025. This minor update contains the latest bug fixes and improvements for this tool.

For more information about this release, visit the GitHub release page.

How to upgrade Terminus

If you manage your installation via Homebrew on macOS, you can update Terminus with the following command:

For other systems, see additional upgrade instructions here.

Today we releasing a new "Push to Pantheon" GitHub Action. This Action provides a reusable step so that, in a few lines of yml, teams using GitHub Actions and Pantheon together can push their code from GitHub to Pantheon inside of a larger workflow that they control.

This Action is designed to create a Multidev environment environment for each pull request:

Here is the configuration that would go within a .github/workflows/deploy-pr.yml file to accomplish this workflow.

The Action can push code to the Pantheon Dev environment upon pull request merges (or direct pushes to a main branch).

See the readme file within the repository for full usage instructions.

While this Action is already in use on live websites we recommend testing it thoroughly with your own sites before fully relying on it. Prior to the 1.0.0 release, we recommend that only teams with pre-existing continuous integration experience adopt this Action. In addition to this Action that is meant for teams interested in customing their Continuous Integrations workflows, we are also developing a direct GitHub Integration meant for simplicity.

For questions and support, please use the issue queue on the repository. For more background on why we made this Action and how it fits in our ecosystem, see this blog post from Director of Developer Relations, Steve Persch.

Today we are making a new GitHub Application for direct integration with Pantheon available as a private Beta. Let us know here if you would like access to this GitHub Application turned on for your Pantheon workspace.

Similar to our recently released Action, this GitHub Application also moves code to Pantheon Multidev environments and the Dev environment to correspond to changes made to a repo on GitHub.

This Application is intended for teams that want the simplest possible tool for achieving the above workflow. Once it is turned on, no additional configuration is necessary.

The GitHub Action is intended for teams who want to make customization to their workflows and treat the deployment of code as one step in a larger Continuous Integration workflow.

More information

• See our documentation page for more instruction on usage and a breakdown of current limitations.
• For support and questions, please file issues on the queue of the related plugin.
• For general feedback and to express interest in similar integrations with BitBucket, GitLab or other services, please see our roadmap.