Compromising a site through a Drupal vulnerability is a common story. According to statistics, 80% of successful attacks exploit known CVEs for which patches have already been released. Regular core and module updates are the only way to protect yourself. According to Drupal.org, more than 90% of vulnerabilities are closed by security updates. We help clients perform this process safely and without surprises. Our engineers have 7+ years of experience with Drupal 7/8/9/10 and guarantee rollback at any point.
Drupal uses Composer for dependency management — core and module updates go through it. Without Composer (manual installation), you should switch to a Composer-based setup, otherwise every update becomes a manual operation. We migrate projects to Composer and configure CI/CD for automatic updates. This reduces update time by 3x compared to manual work.
What Problems Do We Solve?
Outdated Modules and Their Dependencies
Using composer outdated "drupal/*" and drush pm:security, we identify modules requiring updates. Often modules have mutual dependencies, and updating one can pull a chain. We analyze the dependency graph and update everything with a single composer update "drupal/*" --with-all-dependencies command to avoid conflicts.
Version Conflicts During Major Updates
When upgrading from Drupal 9 to 10, many contributed modules may be incompatible. We use Upgrade Status for preliminary analysis and Rector for automatic custom code fixes. If a module has no alternative, we adapt it for the new version.
Data Loss Due to Missing Backup
The biggest mistake is skipping a backup. We always create a full database dump and file archive: drush sql:dump --result-file=/backups/drupal-$(date +%Y%m%d).sql --gzip and a files backup. We test on a copy to eliminate production downtime.
A case study: for an e-commerce site on Drupal 9, we set up CI/CD on GitLab CI. The pipeline automatically created a backup, updated core and modules, ran Nightwatch tests, and applied changes to staging. As a result, manual update time dropped from 4 hours to 30 minutes, and error risk decreased by 80%.
Drupal Update Process
The Drupal core and module update consists of 6 sequential steps:
- Create a backup of the database and site files.
- Check available updates via
composer outdatedanddrush pm:security. - Update core and all contributed modules.
- Apply database schema updates via
drush updatedb. - Test on a staging environment (PHPUnit, Nightwatch).
- Deploy to production and monitor for errors.
Preparation and Backup
drush sql:dump --result-file=/backups/drupal-$(date +%Y%m%d).sql --gzip tar czf /backups/files-$(date +%Y%m%d).tar.gz /var/www/site/web/sites/default/files drush state:set system.maintenance_mode 1 --input-format=integer drush cr Check Available Updates
composer outdated "drupal/*" drush pm:security Update Core and Modules
composer update "drupal/*" --with-all-dependencies drush updatedb drush cr For major updates additionally:
composer require drupal/core-recommended:^10 --update-with-all-dependencies vendor/bin/rector process web/modules/custom Testing
drush state:set system.maintenance_mode 0 --input-format=integer drush cr ./vendor/bin/phpunit web/modules/custom drush watchdog:show --severity=Error --count=50 Update Type Comparison
| Update Type | Time | Risks | Tools |
|---|---|---|---|
| Minor (10.2 → 10.3) | 1-2 hours | Low | Composer, drush |
| Major (9 → 10) | 1-3 days | Medium | Upgrade Status, Rector |
| Security | 30 minutes | Minimal | Composer audit |
Importance of Timely Security Updates
Vulnerabilities in modules are the most common cause of hacks. Security patches are released monthly, and delaying them increases risk. CI/CD allows automatic application of such updates during off-hours, minimizing user impact.
How to Avoid Drupal Update Mistakes?
| Mistake | Consequence | Solution |
|---|---|---|
| No backup | Data loss | Always create a backup before updating |
Skipping drush updatedb |
Database incompatibility | Always run drush updatedb |
| Ignoring module compatibility | White screen | Check via Upgrade Status |
Example of a failed update
One client tried to update a module without a backup and got a white screen. We restored the site in 2 hours, but with a backup the update would have taken 15 minutes. More details in our process.What Is Included in the Update Work
- Full database and files backup
- Core update to the latest compatible version
- Update of all contributed modules
- Custom code compatibility check (for major migrations)
- Testing on a site copy
- Documentation with change description
- CI/CD configuration for automatic updates (GitHub Actions, GitLab CI)
Timelines and Cost
Planned core and module update — from 2 to 4 hours, cost upon request after audit. Major migration (Drupal 9 → 10) — from 1 to 3 days, cost calculated individually. CI/CD setup for automatic updates — from several hours, pricing based on complexity; automation pays off after 3–4 update cycles. Get a consultation on updating your Drupal site and contact us for an optimal maintenance plan.