Automatic Updates

Automatic Updates is the drupal.org project automatic_updates. It updates a Composer-managed Drupal site from its own admin interface, without a developer typing Composer commands. Stable release 4.1.0 of 20 January 2026 works with Drupal ^11.2. It is a contributed module and is not part of Drupal core.

How Automatic Updates works in Drupal 11

The module sits on top of Package Manager, a core module with no user interface. Package Manager makes a temporary copy of the live site, runs Composer changes on the copy, and syncs the result back into the live site. In Drupal 11.4.10 its info file marks it lifecycle: experimental and hidden: true, and the drupal.org documentation calls Package Manager an experimental extension.

Automatic Updates 4.0.0 (11 June 2025) moved to core's Package Manager instead of a bundled copy. The 4.1.0 module declares dependencies on package_manager and update. It adds the update form at /admin/reports/updates/update and a readiness check at /admin/automatic_updates/status. Both need the administer software updates permission.

The settings form offers "Unattended background updates" with three levels: Disabled, Security updates only, and All patch releases. They can run through Automated Cron, a request to /system/cron, or the auto-update command-line utility. The installed default is Disabled, according to the 4.1.0 settings file. The form warns that a background update briefly puts the site into maintenance mode. The project page (checked 26 October 2026) still lists fully unattended updates during cron runs as not yet supported.

Package Manager limits what it does. Its help text says it does not support multisite, does not run Git operations, and keeps only one copy of the site at a time. The project page adds that Automatic Updates has no downgrades and no way to undo an update.

Example

The Drupal CMS documentation describes the manual flow, which uses the same update screen: open Reports › Available updates, check whether Drupal core shows "Updates available" or "Security update required", back up the site, open the Update tab and start the update. Drupal asks you to confirm and warns that the process cannot be reversed. When it finishes, you land on the report again with an "Update complete!" message.

Common mistakes

• Running it directly on a managed host. The project page says the module is likely incompatible with most offerings from Acquia, Pantheon or similar providers. For those hosts it recommends running it in a local development environment and pushing the changes to the host.
• Forgetting the commit. Package Manager leaves version control to the site administrator. The changed composer.json and composer.lock must still reach your repository.

For marketing and content teams

The Drupal CMS documentation says security updates need to be applied regularly, and that who applies them depends on how the site is set up. Ask your developer three things: which hosting platform the site runs on, whether unattended updates are on, and who takes the backup. The Drupal CMS Basics project, the foundation of Drupal CMS, lists the module among the ones it includes (checked 26 October 2026).

Sources

• Drupal.org: Automatic Updates project page
• Automatic Updates 4.1.0 release notes
• Automatic Updates 4.1.0 module file
• Automatic Updates 4.1.0 default settings
• Automatic Updates 4.1.0 routing file
• Drupal 11.4.10 source: Package Manager module info
• Drupal 11.4.10 source: Package Manager help text
• Drupal 11.4.10 source: Package Manager ComposerInspector
• Drupal.org: Package Manager module documentation
• Drupal CMS documentation: Updating Drupal
• Drupal CMS documentation: Updating Drupal core
• Drupal.org: Drupal CMS Basics project page