What is the difference between minor and major Drupal updates?

Minor updates (e.g., 10.2 → 10.3) include security fixes and bugfixes, are backward compatible, and take 1-2 hours. Major updates (9 → 10) require module compatibility analysis, may contain breaking changes, and take 1-3 days. We use Upgrade Status and Rector to automate analysis.

How do you roll back an update if something goes wrong?

Before the update, we create a full database and files backup. If issues occur, we restore data from the backup and revert changes via git. We always test the update on a copy of the site before applying to production.

Is Drush mandatory for updating Drupal?

Drush is not mandatory but greatly simplifies the process: automatic DB dump, applying handlers, cache clearing. Without Drush, some operations must be done manually via SQL and the file system. We recommend installing Drush as a project dependency.

How long does a turnkey Drupal update take?

A standard core and module update with backup and testing takes 2-4 hours. A major migration with compatibility and custom code review takes 1-3 days. Exact timing is estimated after auditing your project.

What if a module is incompatible with the new Drupal version?

First, we check if an alternative module with similar functionality exists. If not, we adapt the module's code to the new version or write a custom solution. We also support your modules after the update.

What is the difference between minor and major Drupal updates?

Minor updates (e.g., 10.2 → 10.3) include security fixes and bugfixes, are backward compatible, and take 1-2 hours. Major updates (9 → 10) require module compatibility analysis, may contain breaking changes, and take 1-3 days. We use Upgrade Status and Rector to automate analysis.

How do you roll back an update if something goes wrong?

Before the update, we create a full database and files backup. If issues occur, we restore data from the backup and revert changes via git. We always test the update on a copy of the site before applying to production.

Is Drush mandatory for updating Drupal?

Drush is not mandatory but greatly simplifies the process: automatic DB dump, applying handlers, cache clearing. Without Drush, some operations must be done manually via SQL and the file system. We recommend installing Drush as a project dependency.

How long does a turnkey Drupal update take?

A standard core and module update with backup and testing takes 2-4 hours. A major migration with compatibility and custom code review takes 1-3 days. Exact timing is estimated after auditing your project.

What if a module is incompatible with the new Drupal version?

First, we check if an alternative module with similar functionality exists. If not, we adapt the module's code to the new version or write a custom solution. We also support your modules after the update.

Automated Drupal Core & Module Updates with Composer & CI/CD

Outdated Drupal core and modules are an open door for hacking, as most attacks exploit known vulnerabilities. We update Drupal via Composer, moving the project to a modern managed process and setting up CI/CD for regular updates. Our team handles the entire cycle—from dependency audit to safe deployment and ongoing support—so your site stays secure and runs reliably.

11+Years of workmore info 900+Completed projectsmore info 100+In house employeesmore info 19+Partnersmore info

Development and maintenance of all types of websites:

Informational websites or web applications

Business card websites, landing pages, corporate websites, online catalogs, quizzes, promo websites, blogs, news resources, informational portals, forums, aggregators

E-commerce websites or web applications

Online stores, B2B portals, marketplaces, online exchanges, cashback websites, exchanges, dropshipping platforms, product parsers

Business process management web applications

CRM systems, ERP systems, corporate portals, production management systems, information parsers

Electronic service websites or web applications

Classified ads platforms, online schools, online cinemas, website builders, portals for electronic services, video hosting platforms, thematic portals

These are just some of the technical types of websites we work with, and each of them can have its own specific features and functionality, as well as be customized to meet the specific needs and goals of the client.

Services we offer

Showing 1 of 1All 2062 services

Automated Drupal Core & Module Updates with Composer & CI/CD

Medium

~2-3 days

Our competencies:

Discuss your task

Describe your task — a specialist in the field will review it and suggest a solution.

Cost estimate

If you know exactly what you need to build, or you already have a ready technical brief.

Frequently Asked Questions

Latest works

Development of a web application for FEEDME
1342
Development of an online store for the company FURNORO
1304
Development of a web application for Enviok
1047
CRM development for Chasseurs
1094
Website development for SBH Partners
1169
Website development for Red Pear
593

Show more works

Compromising a site through a Drupal vulnerability is a common story. According to statistics, 80% of successful attacks exploit known CVEs for which patches have already been released. Regular core and module updates are the only way to protect yourself. According to Drupal.org, more than 90% of vulnerabilities are closed by security updates. We help clients perform this process safely and without surprises. Our engineers have 7+ years of experience with Drupal 7/8/9/10 and guarantee rollback at any point.

Drupal uses Composer for dependency management — core and module updates go through it. Without Composer (manual installation), you should switch to a Composer-based setup, otherwise every update becomes a manual operation. We migrate projects to Composer and configure CI/CD for automatic updates. This reduces update time by 3x compared to manual work.

What Problems Do We Solve?

Outdated Modules and Their Dependencies

Using composer outdated "drupal/*" and drush pm:security, we identify modules requiring updates. Often modules have mutual dependencies, and updating one can pull a chain. We analyze the dependency graph and update everything with a single composer update "drupal/*" --with-all-dependencies command to avoid conflicts.

Version Conflicts During Major Updates

When upgrading from Drupal 9 to 10, many contributed modules may be incompatible. We use Upgrade Status for preliminary analysis and Rector for automatic custom code fixes. If a module has no alternative, we adapt it for the new version.

Data Loss Due to Missing Backup

The biggest mistake is skipping a backup. We always create a full database dump and file archive: drush sql:dump --result-file=/backups/drupal-$(date +%Y%m%d).sql --gzip and a files backup. We test on a copy to eliminate production downtime.

A case study: for an e-commerce site on Drupal 9, we set up CI/CD on GitLab CI. The pipeline automatically created a backup, updated core and modules, ran Nightwatch tests, and applied changes to staging. As a result, manual update time dropped from 4 hours to 30 minutes, and error risk decreased by 80%.

Drupal Update Process

The Drupal core and module update consists of 6 sequential steps:

Create a backup of the database and site files.
Check available updates via composer outdated and drush pm:security.
Update core and all contributed modules.
Apply database schema updates via drush updatedb.
Test on a staging environment (PHPUnit, Nightwatch).
Deploy to production and monitor for errors.

Preparation and Backup

drush sql:dump --result-file=/backups/drupal-$(date +%Y%m%d).sql --gzip
tar czf /backups/files-$(date +%Y%m%d).tar.gz /var/www/site/web/sites/default/files
drush state:set system.maintenance_mode 1 --input-format=integer
drush cr

Check Available Updates

composer outdated "drupal/*" drush pm:security

Update Core and Modules

composer update "drupal/*" --with-all-dependencies drush updatedb drush cr

For major updates additionally:

composer require drupal/core-recommended:^10 --update-with-all-dependencies
vendor/bin/rector process web/modules/custom

Testing

drush state:set system.maintenance_mode 0 --input-format=integer
drush cr
./vendor/bin/phpunit web/modules/custom
drush watchdog:show --severity=Error --count=50

Update Type Comparison

Update Type	Time	Risks	Tools
Minor (10.2 → 10.3)	1-2 hours	Low	Composer, drush
Major (9 → 10)	1-3 days	Medium	Upgrade Status, Rector
Security	30 minutes	Minimal	Composer audit

Importance of Timely Security Updates

Vulnerabilities in modules are the most common cause of hacks. Security patches are released monthly, and delaying them increases risk. CI/CD allows automatic application of such updates during off-hours, minimizing user impact.

How to Avoid Drupal Update Mistakes?

Mistake	Consequence	Solution
No backup	Data loss	Always create a backup before updating
Skipping `drush updatedb`	Database incompatibility	Always run `drush updatedb`
Ignoring module compatibility	White screen	Check via Upgrade Status

Example of a failed update

One client tried to update a module without a backup and got a white screen. We restored the site in 2 hours, but with a backup the update would have taken 15 minutes. More details in our process.

What Is Included in the Update Work

Full database and files backup
Core update to the latest compatible version
Update of all contributed modules
Custom code compatibility check (for major migrations)
Testing on a site copy
Documentation with change description
CI/CD configuration for automatic updates (GitHub Actions, GitLab CI)

Timelines and Cost

Planned core and module update — from 2 to 4 hours, cost upon request after audit. Major migration (Drupal 9 → 10) — from 1 to 3 days, cost calculated individually. CI/CD setup for automatic updates — from several hours, pricing based on complexity; automation pays off after 3–4 update cycles. Get a consultation on updating your Drupal site and contact us for an optimal maintenance plan.