Symfony 5.4 end of life
Bug fixes ended in November 2024. Security fixes continue until February 2029, unusually long thanks to sponsored extended support. That makes 5.4 feel safe. It is not the framework that will force your hand, it is everything around it.
| Branch | Bug fixes until | Security fixes until | Minimum PHP |
|---|---|---|---|
| 5.4 LTS | 2024-11 | 2029-02 | 7.2.5 |
| 6.4 LTS | 2026-11 | 2027-11 | 8.1.0 |
| 7.4 LTS | 2028-11 | 2029-11 | 8.2.0 |
Why 5.4 applications get stuck anyway
- Bundles have left. API Platform 3 and 4, Doctrine ORM 3 with DoctrineBundle 2.13+, EasyAdmin 4.x and most maintained bundles require Symfony 6.4 or newer. You are pinned to old majors with their own end of life.
- PHP. 5.4 runs on PHP 8.x, but the old bundle versions you are pinned to often do not, or throw deprecations on 8.3 and 8.4 that nobody will fix.
- Removed in 6.0. Guard authenticators, Swiftmailer, SensioFrameworkExtraBundle annotations and the old security configuration have no path forward. They must be replaced before you can leave 5.4, and the longer you wait, the more code accumulates on top of them.
The path from 5.4
- PHP 8.1 or 8.2 on 5.4, so the tooling and the next bundle versions can install.
- API Platform 2.6 → 2.7 on Symfony 5.4 if you use it. 2.7 introduces the new metadata system as an opt-in and ships the
api:upgrade-resourcecommand. This is where data providers become state providers. - Replace what 6.0 removed: Guard → authenticators, Swiftmailer → Mailer, SensioFrameworkExtra → core attributes, annotations → attributes. Each is its own PR, each deployable on 5.4.
- Symfony 5.4 → 6.4. With the steps above done this is mostly a composer update plus configuration.
- API Platform 2.7 → 3.4 → 4.3 and Doctrine ORM 2 → 3 on 6.4.
- Symfony 6.4 → 7.4, then PHP 8.3 or 8.4.
This is the project most teams postpone because it looks like one big bang. Split into the steps above it is six mergeable PRs, typically €8,000 to €15,000 fixed price including the API Platform work. See services and prices.
Where does your application stand?
Upload your composer.lock and get your upgrade path, the packages that block it, and a readiness score in seconds. Free, no account, no source code.
Dates verified 2026-09-09 against the official release pages. Other deadlines: Symfony 6.4 end of life · API Platform 3 end of life · PHP 8.1 end of life · all end-of-life dates. Also available in Deutsch Nederlands