Updating your Drupal site is a critical task to ensure security, performance, and compatibility. With tools like Composer and Drush, the process becomes streamlined, especially when you want to stay within the same branch (e.g., updating from Drupal 10.4.x to 10.4.y).

In this tutorial, we’ll walk you through the step-by-step process of updating Drupal core, contributed modules, and themes using Composer and Drush, all while keeping everything in the same branch. Whether you're a seasoned developer or a Drupal newbie, this guide has you covered!

Before we start, make sure you have the following set up:

1. A Drupal site managed by Composer: Your site should have a composer.json file in the root directory.
2. Drush installed: Drush is a command-line tool for managing Drupal. You can install it globally or as a Composer dependency in your project.
3. Git (optional but recommended): For version control and backups.
4. Access to the terminal: You’ll need to run Composer and Drush commands.
5. A backup of your site: Always back up your database and files before performing updates.

Got everything ready? Great! Let’s move on.

Step 1: Check Your Current Versions

First, let’s see what we’re working with. Open your terminal, navigate to your Drupal project’s root directory, and run:

This command lists all outdated Drupal packages (core, modules, and themes) managed by Composer. You’ll see something like this:

Next, check your Drush version to ensure compatibility:

You should see output like Drush Commandline Tool 12.5.3.0 If Drush is outdated, update it with:

Step 2: Back Up Your Site

Before making any changes, back up your database and files. Use Drush to export your database:

Copy your site files (including web/ and vendor/) to a safe location or commit your changes to Git:

Safety first!

Step 3: Update Drupal Core

To update Drupal core within the same branch (e.g., 10.3.x to 10.3.y), you have a few options depending on your setup. Here are three methods inspired by the official Drupal release notes (like those for Drupal 10.4.4), tailored for Composer-managed sites:

Option 1: Update with Composer (Recommended)

This is the standard approach for Composer-managed sites. Open your composer.json file and check the version of Drupal core under "require":

The ^10.3 constraint ensures Composer updates to the latest 10.3.x release without jumping to 10.4.x. 

Run:

This updates Drupal core and its dependencies (e.g., Symfony components) to the latest compatible version, such as 10.3.5. Check the output to confirm the update.

Option 2: Specify a Specific Version

If you need a specific version (e.g., 10.4.4 instead of the latest in the branch), modify composer.json to pin the version:

Then run:

Alternatively, you can update directly from the command line without editing composer.json:

This ensures you get exactly 10.4.4, which is useful for testing or aligning with a specific release.

Option 3: Manual Update with Composer Packages

For more control (or if you’re troubleshooting), you can use the separate Composer packages recommended by Drupal.org (drupal/core-recommended or drupal/core-dev). First, adjust your composer.json to use:

Then run:

The core-recommended package includes Drupal core plus a set of pinned dependencies for stability. This mimics the approach in Drupal’s release notes for manual tarball updates but leverages Composer’s dependency management.
 

Note: Stick with your existing setup unless you have a reason to switch (e.g., drupal/core vs. drupal/core-recommended). 

For this tutorial, Option 1 is the simplest for staying in-branch.

Step 4: Update Contributed Modules

Now, let’s update your contributed modules. To stay in the same branch (e.g., 1.x for a module), ensure your composer.json specifies compatible versions. For example:

Run:

Or, to update all contributed modules at once:

Composer will fetch the latest versions within the specified branches. Check the output to confirm the updates.

Step 5: Update Themes

Themes follow a similar process. If you’re using a contributed theme like drupal/olivero, check its version in composer.json:

Update it with:

Alternatively, if you used composer update -W in Step 4, your themes would already be updated along with modules, assuming no conflicts. For custom themes not managed by Composer, you’ll need to update them manually or via Git (if they’re in a repository).

Step 6: Run Database Updates with Drush

After updating files, Drupal might need to apply database updates. Use Drush to do this:

This runs any pending update hooks (e.g., hook_update_N()) from core or modules. You’ll see output like:

Or, if updates are applied:

Step 7: Clear the Cache

Clear Drupal’s cache to ensure the updates take effect:

This command rebuilds the cache and ensures your site reflects the latest changes.

Step 8: Test Your Site

Visit your site in a browser and test key functionality:

• Navigate pages to check for errors.
• Test updated modules (e.g., create a Pathauto alias if you updated it).
• Verify your theme renders correctly.

If you encounter issues, check the logs with Drush:

Step 9: Commit Your Changes

If everything works, commit your updated composer.json and composer.lock files to Git:

Troubleshooting Tips

• Composer conflicts: If you see dependency conflicts, run composer why-not drupal/core 10.4.4 to diagnose.
• Drush errors: Ensure Drush is compatible with your Drupal version (e.g., Drush 12 for Drupal 10).
• Permission issues: Adjust file permissions if Composer or Drush fails to write files.

Updating Drupal core, contributed modules, and themes within the same branch using Composer and Drush is straightforward once you get the hang of it. By following this process—checking versions, backing up, updating with Composer, and finalizing with Drush—you’ll keep your site secure and up-to-date without breaking compatibility.

Have questions or run into a snag? Drop a comment below, and we’ll help you out. 

Happy updating!

Share this

Add new comment

Anyone working with Drupal on a regular basis should come to DrupalCon Atlanta. The city itself is easily accessed, directly connected to innumerable cities around the country and world via its massive airport. Furthermore, the crowd of people sure to attend will be the most engaged leaders of, contributors to, and users of Drupal ready to share and improve each other's work.

Centarro will have a contingent there representing both our client services and Drupal Commerce. At an event like this, we're eager to hear the stories of people using Drupal Commerce to build their own businesses and client sites. In addition to motivating us to continuing our contribution with vigor, these conversations reveal ways our services and features could be improved to serve merchants better.

We'd love to chat at the booth (507/509, toward the center of the hall) or to see you at our session on Wednesday, Drupal Commerce's Starshot Roadmap. As the resident Commerce guys, we'll have Starshot themed coins to give away along with some stellar wristbands that are fantastic for wiping the sweat off your brow in a mosh pit or on a tennis court. (I doubt the Kraftwerk concert Sunday evening will get that rowdy, but we'll be in General Admission and hope to see you there. 🤓)

Since DrupalCon Barcelona, we've been brainstorming and working toward a vision for Drupal Commerce as a project to embrace features of the Starshot initiatives. While we're most excited for Experience Builder, we've started our work on Commerce recipes and are charting out how best to incorporate AI into both the site building and shopping experience. We'll cover all this and more at our session, and we'd love to hear from others working in this same direction.

When Drupal CMS launched, we built a guide to help users get started—but now we’re facing a big question: how does it relate to the existing Drupal User Guide? Should we keep them separate or merge them into a single, streamlined resource? In this post, Joe breaks down the challenges, and explores what’s next.

For Drupalists in the nonprofit sector, the Nonprofit Summit on Monday, 24 March is a must. We also invite all DrupalCon Atlanta attendees to register for the Nonprofit Summit, which promises a highly informative agenda. This is more than just another conference track—it’s an opportunity to connect with mission-driven professionals, sharpen your Drupal skills, and gain insights into how open-source technology can empower your organization. 

Nonprofits and open source share core values—collaboration, transparency, and community-driven innovation. In an era where the nonprofit sector faces increasing challenges, it’s important to remember that Drupal isn’t just a technology choice; it’s a commitment to an ecosystem that aligns with your mission. Attending the summit will reinvigorate your appreciation for the open-source community and provide a refreshing sense of camaraderie when the sector needs it most.

DrupalCon Atlanta 2025 Nonprofit Summit Agenda

09:00-09:15: Welcome 

Stephen Musgrave: Welcome and overview

09:15-11:30: Fireside Chats

• 9:15am: Cristina Chumillas and Pamela Barone: The Future of Drupal CMS
• 10:15am: Emma Horrel: User Experience in Drupal CMS
• 11:15: Tim Lehnen: Drupal for Nonprofits: nuances to bring back to your org 

11:30-11:45: Break

11:45-12:45: Breakout Sessions (Concurrent Roundtable Discussions)

• Improving the user experience on nonprofit websites
• Aspects and features of Drupal that make it the best choice for nonprofits
• When headless might make sense for your nonprofit
• How to have a conversation with technical and non-technical stakeholders 
• Accessibility & inclusive design

12:45-13:45: Lunch

A time for relaxing and networking if you feel like it.

13:45-14:45: Breakout Sessions (Concurrent Roundtable Discussions)

• Getting the most out of Drupal for nonprofit websites
• Harnessing AI for your nonprofit website
• Using Drupal at your membership organization.
• Simplifying content management for nonprofit teams
• Keeping up with advancements in technology on a nonprofit budget

14:45-15:00: Break

15:00-16:00: Recipes

Tim Lehnen: Recipes for nonprofit Drupal CMS users and Q&A

16:00-17:00pm: Optional Networking

Wrap up conversations, meet new colleagues, and explore partnership opportunities.

Here’s a glimpse of the activities and topics covered.

Drupal CMS

The morning is dedicated to Drupal CMS. We will explore how the Starshot initiative launched the first release of Drupal CMS and what the future holds. We will discuss the user experience for nonprofit users and what Drupal CMS means for nonprofit adopters. This portion of the day will be interactive and include plenty of time for discussion. 

Tim Lehnen from the Drupal Association will close out the section by summarizing the big picture Drupal CMS adventure and connecting the open source framework to nonprofit value systems and providing talking points to bring back to nonprofit orgs in support of Drupal. One of the biggest hurdles to adopting Drupal is securing leadership buy-in. The Nonprofit Summit will equip you with the tools to make the case for Drupal with confidence. 

A Lineup of Engaging Breakout Sessions

A diverse set of breakout sessions will ensure you can focus on the topics most relevant to your organization’s needs. Expect discussions on nonprofit-specific challenges, case studies from organizations that have successfully implemented Drupal, and hands-on workshops where you can troubleshoot real-world problems. 

Network with Like-Minded Changemakers

The nonprofit world thrives on collaboration, and there’s no better place to build connections than at the Nonprofit Summit. You’ll meet others who share your passion for social good and open-source technology. You’ll find a community of people eager to share experiences, offer advice, and even explore potential partnerships. Nonprofits are stronger when we work together, and the summit is a perfect chance to forge new relationships.

Join Us in Atlanta!

The nonprofit sector is constantly evolving, and technology plays a crucial role in helping organizations achieve their goals. Whether you’re looking to refine your Drupal expertise, advocate for open-source solutions, or simply find inspiration among your peers, the Nonprofit Summit at DrupalCon Atlanta is the place to be. Mark your calendar, pack your bags, and get ready to be part of a movement that empowers nonprofits through technology.

Register here: https://events.drupal.org/atlanta2025

DrupalCamp England returns! The Drupal community came together in Cambridge for a weekend. Inspiring keynotes, AI innovations and new connections proved the community is stronger than ever.

Fibers is a new feature in PHP 8.1 that brings lightweight and controlled concurrency to PHP.

PHP 8.1 Fibers introduce efficient, non-blocking execution, making Drupal faster and more responsive. Instead of waiting for sequential HTTP requests, Fibers run them simultaneously, reducing load times and enhancing user experience. This optimization is particularly useful when working with multiple cURL-based API calls or external data fetching.

Drupal Use

Real-Time Use Case of PHP Fibers in Drupal

Since Drupal is single-threaded, we can't run true asynchronous tasks like in Node.js. However, PHP Fibers can help optimize performance by allowing tasks to be executed without blocking the main script.

Many online course creators wonder how to effectively manage sales and automatically grant access to educational content. With Drupal and the available modules, we can build a fully functional online store that handles payments and automatically assigns users to purchased courses. We encourage you to read the article or watch an episode of “Nowoczesny Drupal” series (the video is in Polish).

Experience Builder (XB) most prominent UI piece is its preview canvas, where multiple viewport widths are visible next to each other. The preview canvas is meant for placing components, modifying their inputs and moving them around. For that reason, you cannot interact with the contents of each component. What if you do want to try that?

That’s where the new Preview functionality comes in that was built by Jesse Baker, Dave “longwave” Long and Harumi “hooroomoo” Jang, which removes UI chrome and allows the content author to focus on their creation:

With the UI chrome removed, interacting with the individual components in this mode makes sense:

Then there’s the small matter of being able to actually save what you created 😅 Five weeks ago, we introduced basic auto-saving, but that was not persistent. Auto-saving is similar to a browser remembering what you entered in a form for a while, but not forever. Both are needed for a good UX.

So Ted “tedbow” Bowman, Dave, Travis Carden, Lee “larowlan” Rowlands, Felix “f.mazeikis” Mazeikis and I introduced server-side support for actually saving the cool XB component trees that you could already build, preview and auto-save. Next up: updating the UI to actually use it 🤓

Not one, but two new entity types

Two weeks ago, the UI gained the ability to save “sections”, without those actually being saved: the client leapt ahead of the server. That’s still the case, but the server is catching up: “sections” are the user-facing term for what the new Pattern config entity type will store (added by Felix and I). HTTP API support is still missing though, so the UI doesn’t quite work yet.

XB is intended to become a visual page builder for structured and unstructured content alike. Of course, Drupal is heavily biased to structured content, and consequently has some UX aspects that increase the mental load on the Content Creator unnecessarily for simple, one-off unstructured content — typically called landing pages.
After a lengthy discussion — in an issue that will land next week 😇 — we settled on an approach. To achieve the envisioned UX for unstructured content, Matt “mglaman” Glaman, Ted and I introduced a new xb_page content entity type, with only a handful of base fields:

• title (required)
• description  — for meta tags
• components — for XB component tree
• path — for path alias/URL
• status — for published vs not
• finally, for basic bookkeeping: created and changed
• bonus: if the Metatag module is installed, a metatags field

Adding more fields to it is expressly disallowed — for that, use core’s existing node content entity type. This is intentionally simple, stripped down to the absolute essentials, and must be kept that way. No screenshot yet, because only the basic server-side pieces are done; expect progress in future blog posts!

Missed a prior week? See all posts tagged Experience Builder.

Goal: make it possible to follow high-level progress by reading ~5 minutes/week. I hope this empowers more people to contribute when their unique skills can best be put to use!

For more detail, join the #experience-builder Slack channel. Check out the pinned items at the top!

Redux-integrated field widgets progress

The component instance inputs form may need to have additional CSS and JS loaded. This was implemented months ago, and quite elegantly even: using Attach-Css, Attach-Js and Attach-Settings response headers. While elegant, this doesn’t actually scale, because there can be a lot of those to attach, especially when CSS and/or JS aggregation are turned off. So Ben “bnjmnm” Mullins, Alex “effulgentsia” Bronstein, Travis and I moved these from response headers into the response body. Not all elegance is also technically viable!

On that subject: I bet this part of XB will be perceived as magic. 🪄 Magic is a barrier to evolution and contribution. So Ben, Lauri “lauriii” Timmanee, Bálint “balintbrews” Kléri, Dave, Alex, Lee, Pierre “pdureau” Dureau, Brian Perry and I all collaborated to document both “technical components” that enable this:

• the Semi-Coupled theme engine: docs/semi-coupled-theme-engine.md
• the Redux-integrated field widgets: docs/redux-integrated-field-widgets.md

There’s still lots of work to be done in both components to bring Redux integration to all of core’s field widgets (that last doc makes that very explicit). Having docs in place that explain how it works today is crucial to get to that point!

Grab bag

• Another one of many steps towards making XB Component Source-agnostic: Dave, Lauri and I updated the internal HTTP API to get the list of available XB components to inform the client of each component’s Component Source.
• Harumi and Ben broke up our organically grown xb-general.cy.js end-to-end (E2E) Cypress test into feature-specific tests — making our E2E tests more maintainable and easier to evolve.
• Nine weeks ago, XB added Tugboat integration to simplify testing of MRs. In #3475652, James “q0rban” Sansbury, Kristen Pol and Alex made sure that Tugboat-powered previews also have the Starshot Demo Design System pre-installed, making testing XB on Tugboat more enjoyable.

Week 28 was November 18–November 24, 2024.

When selecting a hosting provider for your Drupal or WordPress site, it’s tempting to choose the cheapest option available. After all, it looks like a cost-effective solution up front. But in reality, budget hosting can introduce hidden costs that could affect your website’s performance, security, and long-term stability.

To back up a little and provide context for non-technical website decision makers, let’s answer the question: What role does web hosting play? Web hosting is essentially the service that stores your website’s files and makes them accessible on the internet. The quality of hosting affects everything from site speed to uptime and security.

Having hosted websites since 2003 and worked with providers ranging from budget hosts like DreamHost to cloud services like Amazon Web Services (AWS), Azure, and DigitalOcean, I’ve seen how these choices impact organizations. I am going to break down why specialized hosting providers are often the smarter choice.

Why Budget Hosting Can Cost More in the Long Run

Unless your organization has a dedicated Development or DevOps team, relying on a single developer or IT professional to manage your site hosted on a platform like AWS or DigitalOcean can be risky. This developer needs to handle everything: server maintenance, security patches, and performance optimization. If that person leaves, your site could be left vulnerable, and finding a replacement with the same expertise can be challenging—and expensive.

Specialized hosting reduces reliance on individual expertise and ensures greater stability. On the other hand, specialized hosting providers like Pantheon, Acquia, Kinsta, and Platform.sh handle server management for you. This means you won’t need a developer to manage critical tasks like software updates or security patches.

Key Features of Specialized Hosting Providers

Specialized hosting providers offer features that budget and cloud hosts often don’t, including:

• Staging environments: Budget hosts typically lack staging environments, crucial for testing changes before going live. Without this, you’d need to set up a separate server for testing—an additional hassle and expense. Specialized hosts provide built-in environments where you can test updates with ease.
• Automated backups: Budget hosts often don’t include automated backups by default. With specialized providers, backups are built-in and accessible to developers, making it easier to restore your site or troubleshoot issues.
• Security and updates: Providers like Pantheon and Platform.sh handle server-level security updates automatically. This eliminates the need for a dedicated team or developer to manage these critical aspects.
• Standardized developer access: Specialized hosts follow best practices for Drupal and WordPress hosting. This includes version control systems like Git, ensuring seamless collaboration and reducing onboarding time for new developers.
• Access control for non-technical users: Many specialized hosts provide tools that allow less technical people to manage developer access to servers, reducing dependency on specific team members.
• Website speed: Specialized hosts optimize server configurations for Drupal and WordPress out of the box, ensuring faster load times and better performance without requiring manual tuning. This not only improves user experience but also boosts SEO, helping your site gain better visibility in search engines.

The Bigger Picture: Saving Time and Reducing Risk

If your organization works with multiple developers or plans to expand, specialized hosting provides a safety net. Developers spend less time managing servers and more time focusing on what matters—improving your website. By minimizing time spent on server issues, specialized hosting reduces the risk of downtime, security breaches, or costly mistakes.

While budget hosting may seem cost-effective initially, it can lead to higher costs in the long run. Opting for a specialized Drupal or WordPress hosting provider ensures your website remains secure, scalable, and manageable—saving you time, money, and headaches down the road. Investing in a specialized provider today protects your site’s future and eliminates reliance on a single developer for server management.

Are you interested in moving your website to a specialized host and don’t know where to start? Let’s talk.