Symfony End of Life: Every Version's Dates — 2.8, 3.4 and 4.4 Are Dead, 5.4 Is Security-Only to 2029, 6.4 and 7.4 Are the LTS Lines
Symfony's support model is one of the most predictable in PHP — and the versions people search for are the ones that have been dead for years. Symfony 2.8 LTS ended security support on November 1, 2019; 3.4 on November 1, 2021; 4.4 on November 21, 2023. The supported long-term lines today are 5.4 (security fixes only, until February 28, 2029), 6.4 (bug fixes to November 30, 2026, security to November 30, 2027) and 7.4 (released November 27, 2025, security to November 30, 2029). The standard release 8.0 ended July 31, 2026; 8.1 runs to January 31, 2027.
This page is the reference: every release's dates, the six-month/two-year rule that produces them, why 5.4's security window is unusually long, how to identify what you run, and what to do when your line ends. Per-version detail lives on the Symfony product page.
Key Dates at a Glance
- Symfony 2.8 LTS: end of life 2019-11-01
- Symfony 3.4 LTS: end of life 2021-11-01
- Symfony 4.4 LTS: end of life 2023-11-21
- Symfony 5.4 LTS: bug fixes ended 2024-11-30; security fixes end 2029-02-28
- Symfony 6.4 LTS: bug fixes end 2026-11-30; security fixes end 2027-11-30
- Symfony 7.4 LTS: released 2025-11-27; bug fixes end 2028-11-30; security fixes end 2029-11-30
- Symfony 8.0: end of life 2026-07-31
- Symfony 8.1: released 2026-05-29; end of life 2027-01-31
Symfony EOL Risk Scores
An end-of-life date on its own does not tell you how urgent a version is. We publish an EOL Risk Score (0–100) for every tracked version, combining how long past — or how close to — end of life it is, the attack surface of the software class, whether CISA lists the product in its Known Exploited Vulnerabilities catalog, and whether commercial extended support exists.
| Version | EOL Risk Score | What drives it |
|---|---|---|
| Symfony 2.8 | 50 | End of life November 1, 2019 — recency at maximum; web-framework attack surface; commercial support exists. |
| Symfony 8.0 | 35 | Standard release, end of life July 31, 2026 — a dead version newer than the supported LTS lines. |
| Symfony 6.4 | 10 | LTS, security fixes to November 30, 2027. |
| Symfony 7.4 | 10 | Current LTS, security fixes to November 30, 2029. |
Read the second row twice: a standard release that has passed its eight months scores worse than an LTS three years older, because the score follows the support state, not the version number. Scores update automatically at every site build; every release is on the Symfony product page.
Every Symfony Release: Support Dates
| Version | Type | Released | Bug fixes end | Security fixes end | Status (Aug 2026) |
|---|---|---|---|---|---|
| Symfony 8.1 | Standard | May 29, 2026 | Jan 31, 2027 | Jan 31, 2027 | Supported |
| Symfony 8.0 | Standard | Nov 27, 2025 | Jul 31, 2026 | Jul 31, 2026 | EOL |
| Symfony 7.4 | LTS | Nov 27, 2025 | Nov 30, 2028 | Nov 30, 2029 | Supported |
| Symfony 7.3 | Standard | May 29, 2025 | Jan 31, 2026 | Jan 31, 2026 | EOL |
| Symfony 6.4 | LTS | Nov 29, 2023 | Nov 30, 2026 | Nov 30, 2027 | Supported |
| Symfony 5.4 | LTS | Nov 29, 2021 | Nov 30, 2024 | Feb 28, 2029 | Security fixes only |
| Symfony 4.4 | LTS | Nov 21, 2019 | Nov 21, 2022 | Nov 21, 2023 | EOL |
| Symfony 3.4 | LTS | Nov 30, 2017 | Nov 1, 2020 | Nov 1, 2021 | EOL |
| Symfony 2.8 | LTS | Nov 30, 2015 | Nov 1, 2018 | Nov 1, 2019 | EOL |
Standard releases between the LTS lines (7.0–7.2, 6.0–6.3, 5.0–5.3, 4.0–4.3, 3.0–3.3, 2.0–2.7) each lived about eight months and are all end of life; the full list is on the product page.
How the Symfony Release Cycle Works
- Time-based. A minor every six months (May and November); a major every two years, in November of odd years (5.0 in 2019, 6.0 in 2021, 7.0 in 2023, 8.0 in 2025).
- Standard minors (x.0, x.1, x.2, x.3) get about eight months of bug and security fixes — until roughly two months after the next minor ships.
- LTS is always the last minor of a major (x.4): three years of bug fixes, then one year of security fixes only. 5.4 is the exception, with security fixes extended to February 2029.
- The last minor and the next major ship together (7.4 and 8.0 both on November 27, 2025) with the same features; the major only removes deprecated code. That is why LTS-to-LTS upgrades are routine when deprecations are cleaned up first.
The Three LTS Lines Today
Symfony 7.4 (November 27, 2025) is where new work belongs: bug fixes to November 30, 2028, security fixes to November 30, 2029; requires PHP 8.2 or later. Symfony 6.4 (November 29, 2023) is the safe fallback where a bundle has not caught up: bug fixes to November 30, 2026 — note that date, it is the next one to pass — and security fixes to November 30, 2027; requires PHP 8.1+. Symfony 5.4 (November 29, 2021) is security-only: no bug fixes since November 30, 2024, but security fixes until February 28, 2029, and it still runs on PHP 7.2.5+. Its role is to keep estates that are stuck on an old PHP version patched while PHP is upgraded — not to be a destination.
Symfony 2.8, 3.4 and 4.4 — End of Life
These are the versions still searched for, and each is a real exposure. 2.8 died November 1, 2019 (final release 2.8.52) — anything on it has been unpatched for more than six years and typically sits on an equally dead PHP 5.x or 7.0. 3.4 died November 1, 2021, 4.4 on November 21, 2023. Modern Symfony CVEs (HTTP cache, form validation, security-component authentication issues) are fixed only in supported lines, and the PHP underneath these versions is itself long past end of life. The path is LTS-to-LTS with a PHP upgrade at each hop; where that cannot happen fast enough, commercial support is the bridge.
How to Check Your Symfony Version
bin/console about— prints the Symfony version, PHP version and environment together.composer show symfony/framework-bundle(orsymfony/symfonyon very old projects) — the installed version from the lock file.- In code,
Symfony\Component\HttpKernel\Kernel::VERSION.
The first two numbers decide the support dates. Fleet-wide, the EOL Checker maps a version to its status; the Stack Scanner reads a composer.lock and flags Symfony alongside the PHP version and the other packages that each have their own clock.
Your Options When a Symfony Version Reaches End of Life
- Upgrade LTS-to-LTS. Clean up deprecations on the current x.4 (the deprecation log and the
symfony/upgradetooling make this mechanical), then move to the next major's x.4. Raise PHP as you go: 6.4 needs 8.1+, 7.4 needs 8.2+. - Land on 5.4 temporarily if PHP is the blocker: it is patched to February 2029 on PHP 7.2.5+, which buys the PHP upgrade time without running unpatched.
- Commercial or third-party support. SensioLabs professional support and third-party vendors sell continued security coverage for end-of-life Symfony and PHP versions; see extended support options. A bridge, not a destination.
Frequently Asked Questions
Is Symfony 2.8 still supported?
No. Symfony 2.8 LTS reached end of security support on November 1, 2019 (final release 2.8.52). Symfony 3.4 LTS followed on November 1, 2021 and 4.4 LTS on November 21, 2023. Anything on 2.x, 3.x or 4.x has been unpatched for years; the supported LTS lines are 5.4 (security fixes only, to February 2029), 6.4 and 7.4.
Which Symfony versions are supported right now?
Symfony 7.4 LTS (released November 27, 2025; bug fixes to November 30, 2028, security fixes to November 30, 2029), 6.4 LTS (bug fixes to November 30, 2026, security fixes to November 30, 2027), 5.4 LTS (security fixes only, until February 28, 2029), and the current standard release 8.1 (May 29, 2026, supported until January 31, 2027). Symfony 8.0 ended July 31, 2026.
How does the Symfony release schedule work?
Time-based: a minor version every six months (May and November) and a major every two years. Standard minors get about eight months of support. The last minor of each major — x.4 — is the LTS: three years of bug fixes and one further year of security fixes. Production should sit on an LTS; the standard releases exist so features arrive early for teams that upgrade every six months.
Why does Symfony 5.4 have security support until 2029?
Symfony's official release table gives 5.4 LTS an unusually long security window — end of security fixes February 2029, versus November 2027 for 6.4. Bug fixes for 5.4 ended November 30, 2024, so it is security-only; the extension gives estates on PHP 7.2–8.0 that cannot yet move to 6.4 (PHP 8.1+) a patched place to stand while they upgrade PHP.
How do I check my Symfony version?
Run bin/console about in the project (it prints the Symfony version and PHP version together), or composer show symfony/framework-bundle. In code, Symfony\Component\HttpKernel\Kernel::VERSION. The first two numbers (5.4, 6.4, 7.4) decide the support dates.
What is the upgrade path from an old Symfony?
LTS to LTS: 4.4 → 5.4 → 6.4 → 7.4, fixing deprecations at each step — Symfony's deprecation layer means code that runs without deprecation notices on x.4 upgrades cleanly to (x+1).0. Each hop also raises the PHP floor (5.4 needs PHP 7.2.5+, 6.4 needs 8.1+, 7.x needs 8.2+), so plan the PHP upgrades alongside; see our PHP end-of-life reference.
Is there extended support for old Symfony versions?
SensioLabs, the company behind Symfony, sells professional support that can extend coverage of LTS versions beyond the community dates, and third-party vendors sell security patches for end-of-life PHP frameworks and the PHP versions they run on. Both are bridges for estates mid-upgrade; see our extended support options page for how these programs work.
Related Resources
- Symfony product page — live status, dates and risk scores for every release
- PHP end of life — the runtime floor that gates every Symfony upgrade
- Drupal 7 end of life — modern Drupal is built on Symfony
- EOL Watch · EOL Checker · EOL Risk Score methodology