A Drupal update replaces site code and then applies related database changes to keep the site secure and working. Drupal is a content management system for building websites, and updates matter because unpatched flaws can expose data or hand control to attackers.
Most updates are small fixes or security patches. Major upgrades move between numbered versions and need more planning. A site owner should know which type is offered before acting.
Table of Contents
- How do you know an update is available?
- What does a standard update involve?
- When do new releases appear?
- What can Automatic Updates handle?
- Why does delay carry real risk?
How do you know an update is available?
Drupal includes an Update module that checks Drupal.org for new releases. According to the Drupal Association in the Update module user guide, the page covers core, modules, and themes. Each item shows whether it is a security fix or a feature release.
Site teams should review the Reports > Available updates page on a routine schedule. Security items come first because they address known flaws. Feature updates can follow after testing confirms normal behavior.
What does a standard update involve?
A typical update has two parts: code first, then database. That order matters because new code may expect changed database tables. The Drupal Association describes in the Composer update guide this code-then-database path for Drupal 8 and later.
Never apply the change directly to a live store, membership site, or campaign landing page. A backup gives a path back when a module conflicts. A test copy shows broken layouts or login errors before visitors see them.
- Back up files and database and prepare a test copy away from production.
- Replace code with Composer, using a command such as composer update drupal slash star with all dependencies.
- Apply schema changes with drush updatedb or browser-based update.php.
- Rebuild cache with drush cache rebuild and check key pages and forms.
When do new releases appear?
Core releases follow a regular calendar. Bug-fix releases arrive on the first Wednesday of the month. Security releases arrive on the third Wednesday when needed, while minor feature releases ship about every six months.
Major versions move slower but require more work. The Drupal Association notes in the release-cadence policy discussion that majors now ship about every two years. Sites cannot skip a major, so version 9 must move to 10 before moving to 11.
What can Automatic Updates handle?
Automatic Updates can apply core patch releases without a full manual Composer workflow. It can also cover selected minor updates or security updates run by cron, based on site settings. This option suits small teams that need core patches quickly.
It does not update contributed modules or themes. Those projects still need their own Composer change and test cycle. A site with many contributed modules still needs regular manual maintenance.
Why does delay carry real risk?
Unpatched core or contributed flaws can expose customer data, allow defacement, or permit full site takeover. Drupal powers many government, education, and enterprise sites, so known flaws draw rapid attacker attention. Delay leaves a public target with a documented weakness.
End-of-life branches receive no further security patches. Replatform Radar reports in its Drupal 10 end-of-life overview that Drupal 10 loses security coverage on Dec. 9, 2026 as Drupal 12 ships. Back up the site, test the next version off production, and move before coverage ends.
