This article uses Drupal 9 as an example. However, the information here is also good for Drupal 10 and Drupal 11.
Drupal 9 doesn't have automatic update yet for core, but it is coming. Check the bottom of the page for more information on automated updates. That said, don't let that stop you from using Drupal as a CMS, as it just gets better with each version, and it isn't that difficult to update once you have a system in place.
A note on ongoing development and why it is needed. Since all technologies are moving forward it is important to keep moving forward with it otherwise you will need to do a full rebuild in a few years which will in fact cost more. I will write more about this but Drupal uses other PHP frameworks and libraries and is built on PHP so it has to keep up with the whole PHP landscape.
Okay, with the housekeeping out of the way, we first need to check for updates for your Drupal instance.
Checking For Updates
We can check for updates using the UI fairly easily. Visit the Status Report and Updates pages. If you have your site set up correctly, you can have automated emails sent to you when new updates are available as well.
Below are some pages you should get familiar with to overview your site's status and updates.
Status Report: Full site overview gives you a high-level overview of your site, it can be found at the below path.
/admin/reports/status
Available updates: Nicely presented page colour-coded for updates needed.
/admin/reports/updates
Update: Displays needed updates and enables one-click UI updates for modules.
/admin/reports/updates/update
Once you know your site needs updating you need to prepare it.
Preparation
You will need to login into your sites hosting account and be in the directory that your Drupal site that needs updating is in.
Make a backup
tar -cvf my-drupal-site_todays-date-BU.tar my-drupal-siteor use archive in cPanel if you use cPanel.
Backup database
By far the easiest way to back up your site's database is to use Backup and Migrate, if you have it installed visit the modules page and back up your database. See Backup and Migrate Module for more details. You can also use MySQL dump or a UI such phpMyAdmin. Whatever your choice is don't forget this step.
Put the site offline
You can easily put the site into maintenance mode using the UI of Drupal, visit the Maintenance mode page.
Administration > Configuration > Development > Maintenance mode
/admin/config/development/maintenance
Or you can use Drush if you are using shell and have installed Drush.
drush state:set system.maintenance_mode 1What is Drush?
It is Drupal Shell, DrupalShell, Drush. Drush needs to be set up and the path needs to be set up. To learn more about Drush I wrote a Drush quick start guide. Check the post to see up Drush then run the above command.
Manual Updates of Drupal
You will need access to the server either using cPanel, an FTP Client file browser, or shell access.
If you need an update check the release page, these are given to you on the Update pages mentioned above. Below is the Drupal releases page and the release page for 9.0.7
https://www.drupal.org/project/drupal/releases
https://www.drupal.org/project/drupal/releases/9.0.7
Download the file and upload it to the directory that your instance is in.
Or copy the link location which looks like this https://ftp.drupal.org/files/projects/drupal-9.0.7.tar.gz and use wget to download the file and then extract the content first using gunzip and tar -xvf
Replace the drupal-9.0.7.tar.gz with the correct release.
wget https://ftp.drupal.org/files/projects/drupal-9.0.7.tar.gz
gunzip drupal-9.0.7.tar.gz #gunzip may not be needed, try without first
tar -xvf drupal-9.0.7.tarDelete all the files and directories that come with Drupal core, what we are doing is replacing every file from the new release archive, in most cases most of the files will be the same. If you check the release notes you can see what files have been updated and what issues they fixed.
cd into the root directory of the Drupal instance you are updating and run the below commands.
rm -rf core vendor
rm -f *.* .[a-z]*Now we need to copy the files from the new release into the root of your Drupal site. cd into the release directory.
cp -R core vendor /var/www/example.com/public_html/my-drupal-site
cp -R *.* .[a-z]* /var/www/example.com/public_html/my-drupal-siteCheck for changes to .htacess, settings.php, robots etc. and replace if needed, this will be noted on the release page.
Run update.php by visiting the page logged in or by running the Drush commands, then put your site online and flush the cache.
drush updatedb:status
drush updatedb
drush cache:rebuild
For more information, you can check https://www.drupal.org/docs/updating-drupal/updating-drupal-core-manual…
Composer Updates
It is assumed your site is off-line, if not go back and check the top of the page put the site offline or if are using Drush you can use the below command.
drush state:set system.maintenance_mode 1Using composer we can check for outdated modules using show and the -o flag, plus we can stipulate just Drupal packages by passing drupal as the vendor and * to show all Drupal packages like so
composer show -o "drupal/*"Output
drupal/admin_toolbar 2.3.0 2.4.0 Provides a drop-down menu interface to the core Drupal Toolbar.
drupal/backup_migrate 5.0.0-rc1 5.0.0-rc2 Backup and Migrate Drupal Module
drupal/core 9.0.6 9.0.8 Drupal is an open source content management platform powering millions of websites and applic...
drupal/core-recommended 9.0.6 9.0.8 Locked core dependencies; require this project INSTEAD OF drupal/core.To update a Drupal install set up using core-recommend run the below command, core-recommend is the official recommended profile.
composer update "drupal/core-*" --with-all-dependencies
# update article 2023 to use the above
# composer update drupal/core-recommended --with-dependencies Using composer update "drupal/core-*" --with-all-dependencies you may not get the message Nothing to install or update. However, if you do please read on.
If this doesn't work and you get Nothing to install or update you may need to run composer require.
The command will sometimes only update dependencies and if that is the case you will need to use composer require.
Sites I have upgraded from Drupal 8 seem to face this issue, it's not really an issue though, use the following command.
composer require drupal/core-recommended:^9.0.0 --update-with-all-dependenciesAfter running composer update successfully you will get the message that it was a success and the composer.json lock file is updated.
Then all we needed to is check for database updates, run the updates, put your site online and then rebuild the cache.
drush updatedb:status
drush updatedb
drush state:set system.maintenance_mode 0
drush cache:rebuildYou should get no output if now check for outdated again.
composer show -o "drupal/*"So that's it, not difficult to update Drupal at all. Spending the time to get familiar with the command line will be beneficial, and setting up Composer and Drush makes it an even faster process, so I definitely recommend that. That said, cPanel or shell access and manual no composer updates are really only a few more lines of commands or clicks.
The most important thing is, do back up and test the updates on a staging site first. If you need help setting up a site or updating a site, be sure to get in contact.
Drupal Automatic Updates
I did some testing of Automatic Updates in Drupal, and at the time it was good. I tested it on a shared hosting account and also a Digital Ocean VPS set up with Ubuntu.
The shared hosting was a breeze, and it worked as advertised. This is because the shared hosting used CentOS as the operating system. CentOS has the correct user and group permissions as default setting.
Ubuntu was insecure due to permission I had to set. With a little more knowledge of how to harden Ubuntu it could work, or you could use it on a private server to test updates and then push it to a production server.
The above requirement is noted on the Drupal project page linked above. It says, "Drupal must be able to change its own code base. Not all hosting environments allow this...".
Drupal Automatic Update is a good module to add to your workflow. If you do use it on a live site that uses a shared host, then you will still need to make a backup of your site before it is run.
I hope you found this article useful. If you are interested in Drupal, front-end development, and design, be sure to sign up for the newsletter over there to the right or at the bottom of the page. Thanks for reading and see you soon.