How to do Drupal updates

Before You Begin

It is highly recommended to use a dedicated feature branch in Git to perform and test Drupal core and contrib module updates. Normally, a given repository will have an updates branch for this purpose.

Updates are normally performed and tested on a developer’s local machine in a DDev or Lando environment. Assuming a project has already been set up using one of these, you are ready to begin updating Drupal core and contrib modules.

Let's Go!

In your machine’s terminal, navigate to a project’s directory.

In the root directory of the project, start it up: ddev start

Pull a fresh copy of the remote database: ddev pull [pantheon|forge|platform] [--skip-files] [--skip-db]

Git 'Er Done!

Check out the master or main branch: git checkout master

Pull the code from the remote branch: git pull origin master

Check out the updates branch: git checkout updates

Merge the code from the master branch: git merge master

Composer Operations

All of our sites use the drupal-recommended project. We use composer to update Drupal core & modules.

To update Drupal core, use: 

composer update drupal/core-* --W

Sometimes after running this command you may get an error. The quick fix is to append the names of those packages that are causing the issue

Ex: composer update drupal/core-* <project_name/package_name> <project_name_2/package_name_2> --W

To update a Drupal module, run:

composer update drupal/<module_name> --W

Alternatively, you could also update it by installing it again with

composer require drupal/<module_name>

To Update A Patch

Update the path of a given patch in composer.json to the newer version 

{
    ...
    "extra" : {
        "patches" :{
            "package/name": {
-               "Old Patch description": "https://patch-source.org/path/to/old-patch-file.patch"
+               "New Patch description": "https://patch-source.org/path/to/new-patch-file.patch"
            }
        }
    },
    ...
}

and then run
composer update --lock

This updates the composer.lock file with the new patch and any required dependencies.

If there are no more composer errors, you can proceed with testing the site.

Clear the Drupal cache: ddev drush cr

Update the database: ddev drush updb -y

Perform visual and functional tests. Check that no front-end and admin pages are broken. Create, a new node. Edit, and then delete it.

After performing the required checks on your local machine and confirming that there are no issues, you are ready to begin the next phase.

Code Review

Commit your changes to the updates branch:

git add .

git commit -m “Core 10.x.y and module updates …”

git push origin updates

Submit your pull request (PR) for review. PR’s are reviewed by the project’s Dev Prime or, if you are the Prime, the Dev Alternate. 

Once the PR is approved, you can now merge the PR into the master (or main) branch. Sometimes, the reviewing dev may choose to merge it on your behalf. If the repo is configured with a Github deploy action, merging triggers routines that deploy the code to the project’s remote platform (Pantheon/Forge/Upsun).

Useful Composer Commands

To get a list of all the installed projects, including non-Drupal:

composer show

To show only  a specific  project

composer show | grep <package_name>

To see outdated composer packages, use:

composer outdated

To see only Drupal outdated packages use:

composer outdated | grep drupal

Use composer prohibits to see what’s stopping it from updating:

composer prohibits <project_name/package_name> <version.number>

To check  something is a dependency:

composer why <project_name/package_name>