Pantheon release notes

Composer 2.8.3 is now used in both application containers and Integrated Composer environments.

Automatic rollout - No action required

Composer 2.8.3 will roll out automatically. No action required from you during this process.

Breaking changes

Developers should be aware of a potentially breaking change introduced in 2.8.0. The fallback behavior from https_proxy to http_proxy has been removed, as previously warned in 2.7.3. If your configurations depend on this behavior, update them to avoid connectivity issues.

Highlights

Composer 2.8.3 introduces a range of improvements and updates made between versions 2.7.7 and 2.8.3, including:

• --patch-only flag for updates: Limit updates to patch versions with this new flag for the update command.
• Improved interactive package updates: Enhanced package display makes interactive updates more intuitive.
• JSON schema validation: New validation ensures integrity for composer.lock files.
• PHP 8.4 compatibility: Compatibility updates for the latest PHP version.
• Bug fixes: Resolved issues with provider suggestions and lock file schemas.

View an overview of the changes made between 2.7.7 and 2.8.3 by comparing the tags or explore the highlights on Composer's Releases page.

Notes

• Composer commands can be executed on Pantheon via the Terminus Composer plugin.
• For operations that modify version-controlled code (like adding a module via composer require which will change composer.json and composer.lock), you must run such commands in Dev or Multidev environments where version controlled files are writable. Such files are not writeable in Test and Live environments.
• To learn more about Composer on Pantheon, visit our guide on Integrated Composer.

We’ve added a feature to the billing section of the Pantheon dashboard that helps you quickly check the status of your most recent invoice.

What's new?

• Status tags: Your latest invoice now displays a "Paid" or "Unpaid" tag for easy tracking.

This update makes it easier to stay informed about your latest payment without impacting dashboard performance.

What's next?

This effort towards improved billing visibility in the dashboard lays the groundwork for further improvements down the road. In a future update, we plan to apply "Paid" and "Unpaid" tags across all invoices, rather than just the most recent invoice.

Editorial notes:

• The date of the auto-upgrades has been updated from February 25 to March 12.
• As of January 29, 2025, this release note has been edited to amend the action required. Where previously we required upgrading 5.3 and 5.5 to 7.2 we are now allowing upgrades to 5.6 as well. This can be helpful if you choose to upgrade PHP versions incrementally rather than making the jump to 7.x.

---

As part of our continued effort to protect and secure customer sites, the Pantheon platform will no longer offer PHP versions 5.3 and 5.5 as of March 12, 2025.

PHP 5.5 was declared end-of-life (EOL) by the PHP Foundation on July 21, 2016, more than eight years ago. EOL software does not receive security or feature updates, and could expose sites to attack if any vulnerabilities or exploits are discovered.

We will soon provide long term support (LTS) security coverage for the remaining EOL versions of PHP on the platform.

Action required

Customers with sites using PHP 5.3 and 5.5 should test and upgrade the PHP version to at least PHP 5.6. If no action is taken, sites using PHP 5.3 and 5.5 will be auto-upgraded to PHP 5.6 on March 12, 2025. Pantheon currently recommends at least PHP 8.1 for all production sites.

Sites created with custom upstreams using EOL PHP versions may also have unexpected behavior upon site creation.

Drupal CMS is available to install on Pantheon. Released today by the Drupal Association, Drupal CMS is a new packaging of functionality that combines powerful, user-friendly content creation and management tools with robust flexibility and scalability for developers and end-users alike.

For installation details, check out the new Drupal CMS docs. Please join us in the Pantheon Community Slack or our livestream at 11am Pacific time to celebrate the release!

Our support team is ready and available if you have any questions or issues configuring your new Drupal CMS site.

What's new?

An improved support experience for Advanced Global CDN (AGCDN) customers is now available in the Edge tab of your professional workspace.

From this tab you can now submit a change request form for modifying AGCDN configurations. After the form is submitted, a new AGCDN support ticket is created with improved routing internally - resulting in fewer delays and faster updates.

To learn more about this experience, see related documentation.

Why is this being done?

Previously, the Advanced Global CDN service lacked a dedicated category within the Support dashboard. This could result in delays and inefficiencies when processing requests, as critical details were often missing or had to be clarified through additional communication. The new Change Request Form is designed to collect all necessary details upfront.

What's next?

The roll-out of this form is a first step toward providing Pantheon's AGCDN customers with a dedicated area in the workspace to make AGCDN changes. In the future, we'd like for customers to be able to make AGCDN configuration changes on their own, if they choose to do so.

We are pleased to announce the release of an upgraded Solr 8 version (8.11.4) that resolves recently reported security vulnerabilities affecting prior Solr8 releases. This update addresses a vulnerability identified in CVE-2024-45216, although this vulnerability did not directly impact the Pantheon platform's security.

What's new?

• Security vulnerability fixes: This release addresses the latest CVE impacting previous versions of Solr 8.
• Critical security patches: Key patches have been applied to mitigate potential exploits and enhance overall system security.

Pantheon's Long-Term Support (LTS) for Drupal 7 is now available. The default Pantheon Drupal 7 upstream has been updated to include the Tag1 Drupal 7 Extended Support (D7ES) module. This module is essential for leveraging our ongoing LTS offering.

What's new

With this update, future LTS releases for Drupal 7 Core and the D7ES module will be provided through Pantheon’s Drupal 7 upstream. For details, see our Drupal 7 LTS documentation.

Action required

To continue receiving security coverage for contributed modules:

• Apply the latest upstream update to your Drupal 7 site.
• Enable the Tag1 D7ES module in your environment and configure the email address for notifications.

About Drupal 7 Long-Term Support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites for at least two years beyond the official end-of-life date on January 5, 2025. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

The Solr Search for WordPress plugin v2.6.0 update is now available.

What's new

Features

• Introduced the new is_solr_query filter to enhance query customization.
• Added the solr_power_customer_schema_file_path filter to set an alternative path for the custom schema file.

Bug fixes

• Fixed the default custom schema file path for Composer-managed and non-standard uploads directories.

Upgrade the plugin now to take advantage of these improvements and fixes.