Decide on Drupal 9's EOL date range (and therefore, Drupal 10's release date range)

Symfony 4.4 goes EOL in November 2023.

Symfony 5.5 goes EOL in November 2025.

So if we release Drupal 9 with ckeditor 4 and Symfony 4, we're going to run into dependency security support issues in 2023 with both of them.

Symfony 6.0 is released in November 2021 - so the very earliest we could release Drupal 10 with a long run on a Symfony version would be mid-2022.

For me, at the moment at least: The ideal situation would be a mid-2020 Drupal 9 release on Symfony 5 and supporting CKE5, then aim for a mid-2022 Drupal 10 release on Symfony 6. This gives us the longest possible period to continue security support for them.

It means a two year development cycle - 9.0, 9.1., 9.2., 9.3/9.LAST/10.0. Then if we continue to offer one year community support for 9.LAST and the LTS programme picks up from there, then that LTS programme still has security support for dependencies for a further two years (i.e. Symfony 5.4's EOL is November 2025). i.e. you get 3 years of community support from the original release, and 4.5 years before security support gets properly difficult to provide due to dependencies.

If on the other hand we release on versions that are already entering their own LTS phase, we're going to keep running into deadlines everywhere we go.

Therefore, upgrading Drupal from CKE4 to CKE5 in a Drupal 9.x minor would violate semver.

We could however introduce support for CKE5 in a Drupal 9 minor release and deprecate CKE4 - this doesn't particularly help with CKE4 dropping security support, but it would mitigate it at a push. Massive difference from PHP dependencies is being able to switch between versions in the same code base based on configuration, so it's a slightly different problem to PHP dependencies and any breakage is more isolated.

At DevDays Transylvania, @xjm said Drupal 10 release estimated middle of 2022 and Drupal 9 end of life estimated end of 2023. It did not seem like we have too much breathing room. Also with the recent Symfony support changes we may need to release Drupal 9 much sooner. What is left for us to decide here? :)

(Removing Drupal 9 branch issue as parent as this is not at all a requirement for that now).

So I think our default position needs to be that we release Drupal 10 on Symfony 5.4 in mid-2022.

However I also think we should actively explore things like removing composer.lock from core and allowing sites to use Symfony 5 during the 9.x lifecycle, as well as decoupling from some of our more awkward dependencies when we can, so that we can move from near-zero flexibility with our release cycle to having a bit more control over it ourselves.

Makes sense. So looks like we either close this for now, or we keep it open for quite a bit longer given we'd need to do all the refactoring work first to make Drupal 9 less reliable on its dependencies.

Didn't see this issue before now, but I've also been communicating to people that we need to release D10 in mid-2022, and that the best we can do for D9's EOL is the end of 2023. It's even in the issue title of #3118143: [meta] Release Drupal 10 on December 14... or 15... 2022.

...Which I meant to add as the parent.

Drupal 9 EOL at end of 2023 was presented by Dries at DrupalCon Global as well as Drupal 10 target release date in 2022. See this slide:

So I think we have answers for all questions here. See more at https://dri.es/state-of-drupal-presentation-july-2020