Extended Drupal 7 support

Drupal 7 reached its official End of Life on 5 January 2025. As part of the Transforming Oxford’s Digital Communications programme, arrangements were put in place to ensure continued support for the University’s existing central web platforms during the rollout of Oxford Fresco, the new web platform. 

Over recent months, development work on Fresco has focused on strengthening confidence in the platform through improvements to front-end functionality, usability, and editing reliability. This work has prioritised the elements that users interact with most frequently, helping ensure the platform continues to mature in response to user needs while migration activity progresses.  

In light of this progress, and to support the orderly migration of more complex websites, it has been agreed that the Drupal 7 extended support arrangement will be further extended for Mosaic from October 2026 to April 2027. 

What does this mean for Mosaic websites?

The Mosaic web platform is built on Drupal 7. While the extended support arrangements allow Mosaic sites to continue operating until April 2027, the platform is approaching the end of its lifecycle. Migrating to Oxford Fresco (Drupal 10) therefore remains essential to ensure long-term security, technical resilience, and a consistent user experience. 

In terms of migration timelines, Mosaic's extension to April 2027 only affects a small number of sites, allowing extra headroom for their more complex needs. For most teams, migration timelines remain unchanged and sites will continue to migrate as currently agreed between Site Owners and the Migration team. 

How Mosaic is supported during the transition 

To support Mosaic during this transition period, security support for Drupal 7 is now provided through an external supplier, HeroDevs, via their Never-Ending Support (NES) service. The University’s CMS and Web Platform Team continues to implement the required updates and maintain Mosaic’s customised modules and integrations.  

Throughout its lifecycle, Mosaic relied on the Drupal.org community for functional fixes and security support to its underlying software. Prior to Drupal 7 reaching End of Life, support operated as follows: 

As a mature product, Drupal 7 has not had significant functionality changes for several years, but security support was supplied by the Drupal community until the End of Life date in January 2025. 

Since then, ongoing security support for Oxford Mosaic is being provided through HeroDevs Never-Ending Support (NES), with the CMS and Web Platform Team continuing to implement the required updates. 

*HeroDevs works to the same SLA as was previously provided by Drupal.org.

Platform maintenance and hosting 

In order to meet the requirements to make use of Drupal 7 NES from January 2025, and to continue to operate the platform on the Acquia Enterprise Cloud, Mosaic has been upgraded to the latest versions of:

• Drupal 7
• PHP 
• SimpleSAML (for SSO integration)

A Third-Party Security Assessment for HeroDevs has also been completed with assistance from the University’s InfoSec team.

The Mosaic platform hosting partner, Acquia, are supporting use of HeroDevs Drupal 7 NES. Throughout 2026 and 2027, our engagement with Acquia’s Technical Account Management service will also continue, to ensure that the hosting arrangements for the Platform remain appropriate. This will include, for example, upgrading the database layer to ensure continued compatibility with both Acquia Cloud and Drupal 7 NES.

These arrangements ensure that the Mosaic service can continue to provide security-supported hosting of platform websites until April 2027, while the CMS Platform and Migration projects continue the transition to Drupal 10 on Oxford Fresco.