Skip to content

RFC Adopting a major release policy  #10345

Description

@maxime-rainville

Read our Revising our approach to major release blog post before commenting on this RFC. This will help to contextualise the discussion.

This document does not include details about specific features, many dependencies or design processes (including any topics about future CMS UI/UX, high-demand feature requests, or long-standing functionality issues).

Problematic (a background)

We painted ourselves into a corner in 2019 when we foreclosed any quick Major release.

All the dependencies we rely on follow a major releases cycle that leads them to release new majors every 2-3 years.

More and more of our time is spent on upgrading Silverstripe CMS dependencies. Many of the APIs from those dependencies are directly or indirectly included in our own API. This means that we have to choose between respecting our API contracts and adding support for the latest major. We’ve broken our semver commitments over the last few years to upgrade dependencies (PHPUnit, Swiftmailer, oEmbed).

Our current approach is meant to provide certainty to project owners, but actually increases uncertainty because every few minor releases we end up shipping some breaking changes. Project owners can’t effectively plan how much work will be needed to upgrade between minors.

It also increases the amount of work we have to do, because we jump through hoops to make our breaking changes more palatable. E.g: Dual support for PHPUnit 5.7 and PHPUnit 9.5.

Broad approach

More frequent smaller major releases at regular intervals will allow us to upgrade our dependencies more effectively. This will negate the need for us to do minor releases with breaking changes because we will be able to push all those changes to the upcoming major release.

This will also benefit Silverstripe CMS project owners by enabling them to plan their upgrades with greater confidence.

Major releases will focus, in descending order of priority, on:

  • Upgrading third party dependencies
  • Removing/cleaning up deprecated APIs
  • Implementing architectural changes that can not reasonably be introduced in a minor
  • Reviewing our commercially supported module list

New features will mainly be delivered via ongoing minor releases.

Key objectives

  • The updated policy should allow owners of Silverstripe CMS projects to clearly know when the next major release is scheduled so they can plan their upgrades.
  • The updated policy should clearly communicate the expected support timeline for older major releases.
  • Our releases cycle is aligned to the PHP releases cycle.
  • No more than two major releases are supported at once.
  • New minor releases are only targeted towards the latest major release.

Assumptions

  • Minor/major PHP releases occur every year in November. PHP releases are actively supported for two years followed by one year of limited support.
  • Our latest major release line can be aligned with the latest PHP version.
  • CMS4 is still architecturally sound and we don’t need to do any substantial changes to it.
  • Symfony releases new minors every 6 months. Symfony majors are under active development for two years and are actively supported for 3 years after that.
  • Ongoing support for older majors will not be detrimental to us adding new features to the latest major.
  • We can deliver major dependency upgrades more effectively if we are allowed to break APIs.
  • Using supported dependencies minimise our security risk exposure by ensuring we have access to the latest patch.

Definitions

  • “Active development” means that we are working on adding new features.
  • “Full support” means that we accept bugs at all levels of impact and push regular patches. No new APIs.
  • “Limited support” means that we are only addressing critical security vulnerabilities and critical bugs.
  • “End-of-life” means that a release is no longer supported and that no bug fix will be provided even for critical issues.
  • “Fixed dependencies” are dependencies that Silverstripe CMS relies on and whose APIs are partly included in our own.
  • “Non-fixed dependencies” are required by Silverstripe CMS’s internal logic but are not directly exposed via the Silverstripe CMS API.

Policy proposals

  • New majors are released every two years in the first quarter of odd years. (2023, 2025, 2027, etc)
  • At launch, CMS majors will be compatible with actively supported PHP versions.
  • PHP versions in limited support will not be supported at launch by new majors.
  • At launch, CMS majors will only track the latest stable Symfony major release.
  • At launch, CMS majors will aim to track the latest stable release of all its fixed dependencies.
  • For each major release line, Silverstripe CMS will identify which dependencies it considers a fixed dependency.
  • A CMS major release line will not add support for new major releases of fixed dependencies even if the currently used version is EOL. The only exception is if the upgrade is necessary to fix a high importance bug or security vulnerability.
  • We’ll only support 1 major release line of each fixed dependency.
  • Non-fixed dependencies may be upgraded to new major releases or swap out altogether within a CMS release line.
  • In between major releases, we will aim to add forward compatibility for the latest PHP release.
  • Minor releases only occur against release lines in active development.
  • Older major release lines go out of active development once a newer major is released.
  • Older major release lines will have full support while there’s an actively supported PHP version they are compatible with. (1 year full support)
  • Older major release lines enter limited support once all the PHP versions they target are in limited support or EOL. (1 year limited support)
  • Older majors go EOL once all the PHP versions they target are EOL.

Practical implication

  • CMS4 goes out of active development in December 2022 and will be actively supported until December 2023. It will then enter a period of limited support lasting until December 2024.
  • CMS5 will be released in the first quarter of 2023 and will support PHP8.1 and PHP8.2, but not PHP8.0 which will be in limited support by then.
  • CMS5 will use Symfony ^6.2 and will never support Symfony 7.
  • CMS5 will be updated in the first quarter of 2024 to add support for the next version of PHP.
  • Active development for CMS5 would cease in December 2024. It will be supporting PHP8.1, PHP8.2 and PHP8.3.
  • CMS5 will be EOL when PHP8.3 is EOL in December 2026.
  • CMS 6 is released in the first quarter of 2025.

Transition to a release policy for Silverstripe CMS 4

  • Support for new Symfony versions will not be added to CMS 4.
  • PHP8.1 will be the last PHP version supported by CMS 4.
  • Dual GraphQL v3/v4 support will never be removed from CMS 4.
  • Dual PHPUnit 5.7/9.5 support will never be removed from CMS 4.

Questions

Release management can be a wide ranging topic with lots of implications. When replying to the RFC, please focus on these questions so we can keep the discussion on track.

Release Lifecycle

  • Do we want to extend the “limited support” of old major's so people can choose to skip Majors? E.g.: Upgrade from CMS4 to CMS6 bypassing CMS5?
  • Is there a preferred major release cadence? What would be the rationale for your suggestion?Do we want to reduce the support period for old Majors to 1 years?

Dependency management

  • When does a third party library become part of the CMS API?
  • When we subclass their class (e.g.: SapphireTest)?
  • When we expect a parameter of a specific type?
  • When we return an instance of a class?
  • How do we decide which dependencies are “fixed dependencies”? Do we need an objective criteria or can we do it just by fiat?
  • Do we want to perfectly track Symfony releases? This would mean releasing in even years rather than odd years.

Definitional issue

  • How specific do we want to be with “easy to upgrade”?
  • What does “full support” mean in the context of older majors? Do we need to clarify it more?

Implementation concerns

  • Assuming PHP versions are released in November and we release support for it around March, that gives us around 3 months to add support for new PHP versions. Are we happy with that? Do we need more flexibility?
  • Does this policy need to specify beta/alpha release period for new majors?
  • How do we support community module maintainers to migrate their module to the next major release? What are some of the risks if community modules can not be updated to the latest major promptly?

Note about the RFC process

  • This RFC is not about CMS5 feature development. Once the RFC is accepted in one shape or another and we know when CMS5 is meant to drop, then we will have a follow up card to decide what needs to be in CMS5.
  • Comments and feedback from the community will be taken into consideration by core committers, before decisions are then made by core committers.
  • The RFC will be followed by a PR to add the major release policy to our doc. The policy will be formally adopted once the PR is merged.Planning for the next major release will begin once the policy is adopted.
  • Structuring our release timing aligns with our larger strategy of making the upgrade to newer versions easier. Following the adoption of a release timing policy, we will continue to create and adopt processes that improve the predictability and reliability of upgrades.

Comment submission deadline

1st July 2022

Related

Indicative timeline

This is just for illustration purposes. It’s not necessary what we are going to do.

Silverstripe CMS Major release policy indicative timeline

Pull request

@silverstripe/core-team

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions