Updating Drupal websites: benefits and options

It’s no secret that all software products work significantly better when updated. Drupal is no exception. All websites built with the Drupal CMS benefit immensely from the regular updates of the Drupal core, modules, and themes. On the contrary, ignoring these procedures can bring trouble.

Discover more about the importance of and the options for updating Drupal websites from today’s blog post by the Golems team of Drupal experts.

What are Drupal updates compared to upgrades?

While speaking about Drupal updates, we need to make the terminology clear. You will often hear both the terms “updates” and “upgrades.” While they are sometimes used interchangeably, the standard and the most common practice is to:

• use the term “update” for taking your project to a higher minor version (e.g. D9.0 to D9.1) or applying a patch (e.g. D9.1.2)

• use the term “upgrade” for taking your project to a higher major version (e.g. D8 to D9)

Why update your Drupal website?

Of course, the words “updates are available” may cause annoyance with every software user. On Drupal websites, the information about the security updates comes in form of error messages across all the admin dashboard pages so you cannot escape them, while the information about regular updates is found on the “Available updates” tab under Reports.

Despite the possible annoyance, your website’s core and module updates are necessary to apply regularly for a number of good reasons:

• Security. Websites with no security updates applied are more vulnerable to hacker attacks. Sometimes, the security announcements by the Drupal Security Team for the core or contributed modules are especially critical (marked “highly critical”), which means that available updates need to be installed as soon as possible. Remote code execution, cross-site scripting, access bypass, and other hacker tricks are something you will not want to have on your website — and keeping it up-to-date gives it better protection.
• New functionality. Drupal is moving forward — some versions show it is flying forward in terms of functionality. Updating your Drupal core makes the innovation available to you. For example, the later versions of D8 gave us a stable Media Library for storing and using media in content, drag-and-drop Layout Builder for building the shape of your pages, JSON:API in the Drupal core for outputting website’s data in JSON to third-party apps, and so much more. D8.0 and D8.9 are oceans apart.
• Stable work. The core or module updates often contain bug fixes, improved stability, refactoring for some parts of the code, and so on. This means the maintainers have eliminated some problems and all you need is just to install the fresh and cleaned-up version of the product. The consistency and compatibility of all its components, including their up-to-date versions, is also very important for any website’s performance and smooth work.
• Drupal 9 upgrade “bonus”. Sometimes, updating Drupal gives you specific additional benefits. Namely, keeping your D8 website up-to-date is a key requirement for a quick upgrade to 9. All sites that are using D8.8 or 8.9 can “fly” to Drupal 9 instantly. Another thing that is required for that is checking for deprecated code using tools like Drupal Check, Drupal-rector, or the Upgrade Status and Upgrade Rector modules.

How to update Drupal: available options

The options for updating Drupal are as follows:

1. Composer
2. manual update
3. Drush

Updating Drupal manually

Manual updates are better-suited for users who are not comfortable with the command line. Here is what you will need to do in order to update the Drupal core (see more detailed instructions at drupal.org):

• Do a backup of your files and database. Save files like .htaccess, composer.json, or robots.txt somewhere if you have modified them.
• Put your site in maintenance mode on the Configuration page.
• Go to your file system and delete all files from the top-level directory, as well as the Core and Vendor directories. Do not touch directories as Modules, Profiles, Sites, and Themes, as well as your custom directories.
• Download the needed version of the core.
• Upload it to your file system and extract its files.
• Put the new versions of all the files you have previously removed from the top-level directory.
• Run update.php in your browser by just adding /update.php to your site’s address.
• Go to the Reports page of your admin dashboard and check the results of the update.
• Put your site back out of the maintenance mode.

Updating Drupal via Composer

The most recommended option is to update the Drupal core, modules, and themes via the command-line package manager for PHP-based projects — Composer. If you are updating D8 or 9, using Composer is inevitable, because it’s part of the best practices.

It is especially important to note that projects on D8.8.0 or above are using the drupal/recommended-project while earlier projects are using the drupal-project template, which might cause issues during updates.

This option to update Drupal via Composer is for more tech-savvy users who know the command line and the basics of Composer, and involves these key steps:

• Checking for available updates
  
  composer outdated 'drupal/*'
• Updating the Drupal core (if drupal/core-recommended is used):
  
  composer update drupal/core 'drupal/core-*' --with-all-dependencies
  
  otherwise:
  
  composer update drupal/core --with-dependencies
• Updating the database (here comes Drush):
  
  drush updatedb
  drush cache:rebuild
  
  Or enter /update.php at the end of your website’s address in the browser.
• Updating the production environment
  
  There are also commands for updating Drupal modules:
  - Updating a contributed Drupal module or theme:
  
  composer update --with-dependencies drupal/[your_module_name]
  
  - Automatically updating all your website’s packages listed in your composer.json file:
  
  composer update --with-dependencies

See more detailed instructions on how to update Drupal via Composer on drupal.org for projects on D8.8.0, as well as special instructions for projects prior to D8.8.0. You can also see in more detail how to update Drupal modules.

Updating Drupal via Drush

Updates using Drupal’s command-line tool Drush are becoming a thing of the past. In drupal.org documentation for updating the Drupal core, there is a reminder that updates using Drush are deprecated. Drush 9 and newer no longer support updates, so the Composer is recommended instead. There is still an option to update Drupal with Drush 8.

Hey, what about automatic updates in Drupal?

While reading all this, you might think it’s a pity updates are not automated. Indeed, automatic updates are one of the most exciting features that Drupal users expect. It would significantly improve Drupal’s user-friendliness and make it closer to its competitor — the WordPress CMS. After all, although automatic updates in WordPress sometimes cause troubles when they are not controlled by a professional developer, they remain a great benefit in the eyes of many.

The great news is Drupal is moving towards automatic updates. There are an Automatic Updates Initiative and a contributed Automatic Updates module both for D7 and D8. It is designed to provide auto-updates with cleanliness and security as priorities, so it uses a JSON feed with official security advisories, website readiness checks, hashing, signatures, backups, and more. Currently, it focuses on Drupal core security updates but will expand to other types of updates and contributed modules as well.

It’s Drupal update time!

When was the last time you had your Drupal website updated? Go ahead and check this on the Reports page of your site’s dashboard and schedule an update for the nearest future. You can send a support ticket to our team to make sure your website is updated smoothly.

Wishing you to stay up-to-date,

Your Golems