Automatic Drupal core updates: pros and cons

Drupal has a great way to provide your website with the latest features and make it more protected against new cyber threats. To achieve this, it constantly evolves to keep up with the pulse of the times. All you need is to regularly update to newly released Drupal versions, and your Drupal support provider could help you with that. However, there is an idea floating in the air about how great it would be to have automatic Drupal core updates. We will explore this issue, with its benefits and challenges, in our blog post.

The need for automatic Drupal core updates

The Drupal community fully understands the wishes of website owners. At DrupalCon Vienna in September 2017, Drupal founder Dries Buytaert gave a presentation about the state of Drupal. He emphasized that complicated updates are one of the things that pushes people away from Drupal, and that users are asking for auto-updates. The need to automate Drupal core updates became clear — and grew into the special initiative.

Automatic Updates Initiative for Drupal core & its benefits

So the Automatic Updates Initiative was created with the main aim to build a secure system that would install core updates automatically. The Initiative is meant to:

• reduce website maintenance costs and time
• immediately respond to critical security issues and apply patches
• free users from possible hassle and the complexities all website owners who do updates without a development expert face
• and, finally, give the answer to all customers who keep asking why, despite all Drupal’s awesome strengths, it still has no automatic updates.

The challenges of automatic Drupal core updates

So the idea of automatic updates sounds very lucrative indeed. However, despite the unquestionable benefits, the community also understands that implementing automatic updates for Drupal core meets a number of challenges:

• automatic updates without human supervision may involve great risks — up to and including websites crashing
• there is no testing pipeline
• automatic updates may open opportunities to hackers for mass dependency injections
• there is no GIT version control, so it’s impossible to roll back if something goes wrong
• automatic updates will mostly benefit simple websites with no custom modules, otherwise they will require much more developer attention anyway
• this idea requires a comprehensive restructuring of Drupal codebase, which means it’s not a near-future innovation

Considering that Drupal is a very powerful CMS able to handle extremely feature-rich and complex websites, such thing as automatic updates should be approached with caution.

When it comes to core updates, nothing can replace a developer’s hands at the moment. However, the future may change this, because great work is being done in this realm.

Quick core updates already a reality in Drupal 8!

Luckily, automation is not the only way to facilitate core updates. When it comes to Drupal 8, they are already a snap.

A lot of work has been put into making Drupal updates and even Drupal upgrades easy forever (upgrades are transfers, for example, from Drupal 8 to 9 in the future). This article by Dries Buytaert explains that this is achieved, in particular, thanks to backwards compatibility between the versions and semantic versioning.

Let’s say updating an average website from Drupal 8.5.x to 8.6.x will only take half an hour for our Drupal maintenance team. Smaller updates (like Drupal 8.6.0 to 8.6.1) can be done with the snap of a finger. Overall, it will depends on the amount of custom modules.

By the way, this is yet another reason for Drupal 7 website owners to upgrade to Drupal 8 — for which you can rely on our Drupal website support. Easy upgrades are listed among numerous Drupal 8’s benefits for your business. 

So your wish for easy Drupal core updates can come true right now!

Do you regard automatic updates as the way to forget about everything and have a good night’s sleep? This wish can come true right now! But you don’t have to wait until the Drupal automatic update feature is finally here and well-tested.

Rather, this dream will come true if you apply to our Drupal support firm. All our maintenance packages include watching out for security updates and running them. We can agree the on following not only security, but any other kinds of updates.

Let our experts run all Drupal core updates for you — manually, safely, and reliably!