Automatic Updates in Drupal: How Things are Going With the #1 Requested Feature

Regular updates are the cornerstone of a website’s continual smooth operation, just like regular services on your vehicle. This is an undeniable truth for Drupal just like for any other platform. A website that is kept up-to-date has a higher level of security, offers its users newer functionality, has a lower incidence of bugs, and generally performs better. 

All this sounds great, but there is also another undeniable truth — Drupal website updates are often tricky and time-consuming. They create a lot of hassle for businesses that need to reach out to their development team for help. Indeed, using tools like Composer requires technical skills. When it comes to security updates specifically, they should be applied to websites as soon as issued, and many websites stay vulnerable for a long time before getting updated. This situation has become a potential downside of Drupal in the eyes of customers, users, and site builders. 

No wonder it’s the #1 requested feature for Drupal! Fortunately, automatic updates in Drupal are coming to the rescue - this feature is one of the most important things to be included in Drupal 10 (with the beta functionality already out in Drupal 9 in the contributed module form). Read on to discover more details.

A quick review of the Drupal Automatic Updates Initiative

The Automatic Updates Initiative is one of the key strategic initiatives for Drupal that define the priorities for the CMS. The Initiative’s main goal is to make the update process for Drupal websites a lot easier by automizing it in a safe and clean way. 

This should reduce website maintenance time and costs, ensure that security updates are applied in time, and make Drupal a more popular choice in its competition with other CMSs that already have this functionality. At his DrupalCon Portland 2022’s keynote, Drupal creator Dries Buytaert mentioned that automatic updates were the number one feature request in surveys held amongst thousands of people.

The Automatic Updates functionality is being implemented as a set of experimental contributed modules with a plan of being added to the Drupal core once everything is fully ready and well-tested. 

The progress of Drupal Automatic Updates in 2022

While speaking at his DrupalCon Portland 2022’s keynote, Dries Buytaert said that the team behind the Automatic Updates Initiative had made incredible progress. The functionality is currently in the beta state so anyone can actually go and test it and give feedback. The plan is to have it in one of the first minor versions of the Drupal 10 core, or even in 10.0 in December if the community can help test and finalize it in time, said Dries. However, the current realistic plan is to get it maybe into 10.1 or 10.2.

Another exciting piece of news on the Initiative’s progress has been provided by Ted Bowman, one of its technical leads, in his brief video that became part of DrupalCon Portland 2022’s Driesnote. While the initial version that will be added to Drupal 10 will only support core updates, the team has been working on the ability to auto-update contributed modules and themes as well. Currently, there is a hidden module for this in an early development stage called Automatic Updates Extensions. This functionality needs to be thoroughly tested before it is added to the Drupal core.

How Automatic Updates work: with examples from the creator

“I’ve updated the core and all of my modules

 without ever having to touch the command line.”

— Ted Bowman

• The power of Composer behind a simple UI 

The great news is that Drupal Automatic Updates leverage the Composer package manager under the hood. However, non-technical users should not fear the word “Composer” since there is no need to use the command line — the process is conveniently controlled via simple buttons in the Drupal interface, and Composer works behind the scenes.

• Security measures

The system takes care of the security and cleanliness of the process so it first checks your website’s readiness. There can be various reasons that can prevent it from being ready such as pending database updates, non-writable file system, insufficient disk space, and more. 

It also creates a staged copy of your site to run the update first so you have a chance to cancel it before your actual site gets updated. The website itself is put into maintenance mode unless you have unchecked this in the settings. 

• Attended or unattended mode

The team is working on making the automatic update process available in two modes:

• attended (needs you to press the “Update” button and a couple of others)
• or unattended (entrusted to Drupal’s automatic task handler Cron that will regularly run them without any actions on your part). 

You can choose one or the other with just one checkbox on the module’s configuration page and decide whether to automate all core updates or security updates only.

Ted Bowman demonstrated the latest capabilities of Drupal’s Automatic Updates both in the above-mentioned video as part of Driesnote and the dedicated session “Getting Ready for Automatic Updates in Drupal core: DrupalCon Portland 2022.” 

Let’s take a look at how the functionality works based on Ted’s example of running the security updates for the Drupal core and regular updates for a handful of contributed modules on his website.

1) Automatic security updates for Drupal core in action

On the Reports > Available updates page of the Drupal admin dashboard, we can see the information that the Drupal core needs a more secure version.

The “Update” tab has a very simple form with the “Update” button to start the process. 

Once the button is pushed, the system runs readiness checks to ensure the site meets the basic requirements for updating the Drupal core and creates a copy of the site where it will run the Composer command to update the core. 

After the system runs the Composer command, it inspects the updated copy to see if everything is as expected. In Ted’s case, it has been detected that database updates are needed.

There is a “Cancel update” button that we can use if we do not feel it’s the right moment to run this update, and the site will remain unchanged. If we click “Continue,” the updates will start applying.

As they are applying, the site is put into maintenance mode and certain actions (like another administrator uninstalling a module) are prevented, explains Ted. 

Since database updates are required, we are redirected to the database update page to complete the process. 

As we come back to the Available updates pages to see its current status, we can see the Drupal core is now up-to-date and secure.

2) Automatic updates for contributed modules and themes in action

The Available updates page still lists a number of contributed modules that need newer versions. 

In the Initiative’s progress part, we have already mentioned that there is a hidden module called Automatic Updates Extensions for contributed modules and themes. Ted unhid the module in his example to show what it could do.

With the module enabled, we get a new Update Extensions tab on the Available updates page. We need to select the modules and click “Update.” 

Just like in the core example, a copy of the website is being created where the Composer command to update these modules will be run.

Once the staging copy of the site has been updated, we have a chance to confirm or cancel the actual update being applied to the site.

When the update is done, we will again run the database updates to complete the process. 

As we come back to the Available update page, we can see that the contributed modules are up-to-date as well.

Final thoughts

Although the Automatic Updates functionality is not yet polished for use on production websites, Drupal is on the threshold of getting one of the most exciting innovations in its history that we couldn’t even dream of in the past. Along with the Easy Out of the Box and other initiatives, it should make Drupal so much easier for every user.

Automatic Updates are yet another reason to look forward to Drupal 10 which is coming in December. Our team can help your website get ready for it when it arrives so it smoothly moves into the future!