The release of Drupal 10 has brought many new and exciting features to the table—such as a better content editing experience and a more accessible default theme to name a few.
But one feature stands out from the rest: the Automatic Updates module is the Drupal community’s #1 requested capability according to the 2022 Driesnote.
The module is expected to become a core feature in Drupal 10. It’s currently being developed by folks from Acquia, Pantheon, and BioRAFT among other contributors.
Let’s take a look at its capabilities, benefits, and roadmap below.
Why are Automatic Updates a Priority?
Many Drupal sites take 2-4 weeks to run a security update after it’s released. But while common, these delays put your site at increased risk: hackers will scan for vulnerable sites as soon as they get wind of a security issue.
With such high stakes, you may wonder why so many sites are slow to update. The answer is that Drupal updates have historically been difficult, time-consuming, and expensive to implement. The process requires knowledge of command lines, meaning non-technical users must call in developers to help.
The Automatic Updates module promises to be a gamechanger for Drupal 10 users. It allows you to update Drupal core simply by clicking a few buttons.
Keep Your Drupal Site Secure With Automatic Patch Updates
You can use the Automatic Updates module to automate patch-level updates to Drupal core. Patch updates are the most frequent and least disruptive type of update, as they typically include bug fixes but no new features.
You can’t use the module to automate minor version updates. These are more disruptive as they introduce new features. Minor releases are scheduled approximately every six months and you’ll need to run these updates yourself.
However, it’s possible to let the Automatic Updates module handle security updates on its own for up to a year. This is because the Drupal Security Team releases bug fixes for the two most recent minor versions—meaning it’s not always essential to be on the latest one (with the rare exception that a minor version is needed to fix a severe bug.)
Major version releases are another story altogether. These are considered an upgrade rather than an update, and they require a lot more work. An example is moving from Drupal 7 or 8 to Drupal 10. Watch our on-demand webinar to learn about best practices for Drupal migrations.
Work is currently underway on the Automatic Updates Extension module, which will allow users to automate contributed module updates. This feature will complement the new Project Browser module, which helps users discover contributed modules within the Drupal admin UI. The Automatic Updates Extension module needs a lot more work, but it should eventually become a core feature in Drupal 10.
Using the Automatic Updates Module: A Simple Walkthrough
The Automatic Updates module checks drupal.org and notifies you when there’s a new release. You can see what updates you need to run on the Available Updates page under the Reports menu in the Drupal admin dashboard.
The Available Updates page displays required updates for Drupal core and contributed modules. Source: Drupal.
You’ll need to navigate to the Updates tab and hit the “Update” button.
Update Drupal Core with the click of a button. Source: Drupal.
The Automatic Updates module works in tandem with Composer and Package Manager to perform the updates—meaning you don’t have to write a single command line!
When you hit the “Update” button, a sandboxed copy of your codebase is created (excluding any private files and SQL databases.) The update is performed on the sandboxed copy.
The Automated Updates module detects issues at every stage of the update process. Source: Drupal.
The Automatic Updates module detects any issues during the process. You can customize its API to react to update events if you like. It also tells you if the release requires any database updates.
If your codebase passes the readiness check, you can confirm the update by clicking the “Continue” button.
The Automatic Updates module detects any required database updates. Source: Drupal.
When you hit “Continue”, the updated copy of your codebase is copied back to your actual site. Your site is put into maintenance mode by default during this process to reduce the risk of something going wrong.
The Automatic Updates module puts your site in default mode during the update process. Source: Drupal.
Once the update is complete, the sandboxed copy of your codebase is deleted as it’s no longer needed.
If database updates are required, you’ll be redirected to the database update page to finish the process.
With everything tied up, you can revisit the Available Updates page to see that Drupal core is now updated and stable.
The Available Updates page indicates when Drupal Core is up to date. Source: Drupal.
Limitations of the Automatic Updates Module
The module has a few deliberate limitations as well as some temporary ones as the team continues to finetune it. Here’s what to be aware of.
Unattended Updates
The module doesn’t yet support fully automatic, completely unattended updates (e.g. done during Cron runs.) This should become available when the drupal.org packaging system supports the Update Framework. Also, database updates aren’t supported in unattended updates because a failure could leave your site in a severely broken state.
Git and Version Control
The module isn’t Git or Version Control aware so it won’t commit code after an update. However, it’s likely that we’ll see the development of contributed modules to solve this issue.
Multi-Site Updates
Drupal limits the number of updates that can be run by multiple users at any one time, and it can’t recognize when separate sites have the same owner. The Automatic Updates module is therefore unable to support multi-site updates. However, it may be possible to override this limitation through custom code.
Production Hostings
You currently need a writable file system for the Automatic Updates modules to work. This is more common with low-code sites and low-cost hosting, whereas most production hostings deliberately have read-only file systems. Luckily, the Automatic Updates Initiative Team has a few suggested workarounds.
Planning to migrate to Drupal 10?
Explore other relevant resources from Evolving Web:
📚 Reasons to migrate to Drupal 10
📚 Drupal 7 to Drupal 10 migration guide
📚 Recommended actions for Drupal 7's end of life
🧑🏫 Custom training to empower your team
Evolving Web is a Drupal Certified D7 EOL Migration Partner. We've been supporting organizations through complex migrations since 2007. Partner with us for your move to Drupal 10 and let us do the heavy lifting.