No. On 26 October 2026 the project page describes it as a contributed module that must be installed with Composer, developed as a future feature for Drupal core. Its engine, Package Manager, is in core 11.4 as an experimental module that is hidden in the module list. Automatic Updates 4.x depends on that core module.
' - '@type': Question name: 'Can Automatic Updates update contributed modules and themes?' acceptedAnswer: '@type': Answer text: 'Release 4.1.0 (20 January 2026) merged the Extensions sub-module into the main module, so core and extension updates share one page. The project page still calls extension updates experimental and under heavy development, and not ready for production.
' - '@type': Question name: 'Does it handle minor or major Drupal upgrades?' acceptedAnswer: '@type': Answer text: 'Minor-version core updates are disabled by default and can only be enabled programmatically, according to the project page. Major-version upgrades are not supported. Drupal CMS says its update screen handles core patch updates only.
' - '@type': Question name: 'Does it work on every hosting platform?' acceptedAnswer: '@type': Answer text: 'No. The codebase, including vendor, must be writable, so the Package Manager help calls it incompatible with some hosting platforms. It also needs Composer 2.7 or later in the 11.4.10 source, rsync and proc_open(), and it does not support multisite.
' - '@type': TechArticle headline: 'Automatic Updates' description: "Automatic Updates lets an administrator apply Drupal core patch releases from the browser, with core's Package Manager staging the Composer changes." image: '@type': ImageObject url: 'https://dxpr.com/themes/custom/dxpr_com/images/dxpr-share-card.jpg' width: '1200' height: '630' datePublished: '2026-10-26T18:01:04+0000' dateModified: '2026-10-26T18:01:04+0000' author: '@type': Organization '@id': 'https://dxpr.com/#organization' name: DXPR url: 'https://dxpr.com/' logo: '@type': ImageObject url: 'https://dxpr.com/themes/custom/dxpr_com/dxpr-logo-dark.svg' width: '1348' height: '501' publisher: '@type': Organization '@id': 'https://dxpr.com/#organization' name: DXPR url: 'https://dxpr.com/' logo: '@type': ImageObject url: 'https://dxpr.com/themes/custom/dxpr_com/dxpr-logo-dark.svg' width: '1348' height: '501' mainEntityOfPage: 'https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/automatic-updates' articleSection: 'Drupal glossary' - '@type': WebPage '@id': 'https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/automatic-updates' description: "Automatic Updates lets an administrator apply Drupal core patch releases from the browser, with core's Package Manager staging the Composer changes." breadcrumb: '@type': BreadcrumbList itemListElement: - '@type': ListItem position: 1 name: Home item: 'https://dxpr.com/' publisher: '@type': Organization '@id': 'https://dxpr.com/#organization' name: DXPR inLanguage: en --- [Help Center](/hc)/[Documentation](/hc/documentation) /[Learn Drupal](/hc/documentation/learn-drupal) /[Drupal glossary](/hc/documentation/learn-drupal/drupal-glossary) # Automatic Updates Automatic Updates lets an administrator apply Drupal core patch releases from the browser, with core's Package Manager staging the Composer changes. Learn DrupalDrupal glossary Last updated October 26, 2026 ## In this guide Related terms - [Update](/hc/documentation/learn-drupal/drupal-glossary/update) - [Composer](/hc/documentation/learn-drupal/drupal-glossary/composer) - [Security update](/hc/documentation/learn-drupal/drupal-glossary/security-update) - [Cron](/hc/documentation/learn-drupal/drupal-glossary/cron) - [Project Browser](/hc/documentation/learn-drupal/drupal-glossary/project-browser) - [Drupal CMS](/hc/documentation/learn-drupal/drupal-glossary/drupal-cms) [All Drupal terms from A to Z](/hc/documentation/learn-drupal/drupal-glossary) Automatic Updates is the drupal.org project `automatic_updates`. It updates a Composer-managed Drupal site from its own admin interface, without a developer typing Composer commands. Stable release 4.1.0 of 20 January 2026 works with Drupal ^11.2. It is a contributed module and is not part of Drupal core. ## How Automatic Updates works in Drupal 11 The module sits on top of Package Manager, a core module with no user interface. Package Manager makes a temporary copy of the live site, runs [Composer](/hc/documentation/learn-drupal/drupal-glossary/composer) changes on the copy, and syncs the result back into the live site. In Drupal 11.4.10 its info file marks it `lifecycle: experimental` and `hidden: true`, and the drupal.org documentation calls Package Manager an experimental extension. Automatic Updates 4.0.0 (11 June 2025) moved to core's Package Manager instead of a bundled copy. The 4.1.0 module declares dependencies on `package_manager` and `update`. It adds the update form at `/admin/reports/updates/update` and a readiness check at `/admin/automatic_updates/status`. Both need the `administer software updates` permission. The settings form offers "Unattended background updates" with three levels: Disabled, Security updates only, and All patch releases. They can run through Automated [Cron](/hc/documentation/learn-drupal/drupal-glossary/cron), a request to `/system/cron`, or the `auto-update` command-line utility. The installed default is Disabled, according to the 4.1.0 settings file. The form warns that a background update briefly puts the site into maintenance mode. The project page (checked 26 October 2026) still lists fully unattended updates during cron runs as not yet supported. Package Manager limits what it does. Its help text says it does not support multisite, does not run Git operations, and keeps only one copy of the site at a time. The project page adds that Automatic Updates has no downgrades and no way to undo an update. ## Example The Drupal CMS documentation describes the manual flow, which uses the same update screen: open `Reports › Available updates`, check whether Drupal core shows "Updates available" or "Security update required", back up the site, open the Update tab and start the update. Drupal asks you to confirm and warns that the process cannot be reversed. When it finishes, you land on the report again with an "Update complete!" message. ## Common mistakes - **Running it directly on a managed host.** The project page says the module is likely incompatible with most offerings from Acquia, Pantheon or similar providers. For those hosts it recommends running it in a local development environment and pushing the changes to the host. - **Forgetting the commit.** Package Manager leaves version control to the site administrator. The changed `composer.json` and `composer.lock` must still reach your repository. ## For marketing and content teams The Drupal CMS documentation says [security updates](/hc/documentation/learn-drupal/drupal-glossary/security-update) need to be applied regularly, and that who applies them depends on how the site is set up. Ask your developer three things: which hosting platform the site runs on, whether unattended updates are on, and who takes the backup. The Drupal CMS Basics project, the foundation of [Drupal CMS](/hc/documentation/learn-drupal/drupal-glossary/drupal-cms), lists the module among the ones it includes (checked 26 October 2026). ## Sources - [Drupal.org: Automatic Updates project page](https://www.drupal.org/project/automatic_updates) - [Automatic Updates 4.1.0 release notes](https://www.drupal.org/project/automatic_updates/releases/4.1.0) - [Automatic Updates 4.1.0 module file](https://git.drupalcode.org/project/automatic_updates/-/blob/4.1.0/automatic_updates.module) - [Automatic Updates 4.1.0 default settings](https://git.drupalcode.org/project/automatic_updates/-/blob/4.1.0/config/install/automatic_updates.settings.yml) - [Automatic Updates 4.1.0 routing file](https://git.drupalcode.org/project/automatic_updates/-/blob/4.1.0/automatic_updates.routing.yml) - [Drupal 11.4.10 source: Package Manager module info](https://git.drupalcode.org/project/drupal/-/blob/11.4.10/core/modules/package_manager/package_manager.info.yml) - [Drupal 11.4.10 source: Package Manager help text](https://git.drupalcode.org/project/drupal/-/blob/11.4.10/core/modules/package_manager/src/Hook/PackageManagerHooks.php) - [Drupal 11.4.10 source: Package Manager ComposerInspector](https://git.drupalcode.org/project/drupal/-/blob/11.4.10/core/modules/package_manager/src/ComposerInspector.php) - [Drupal.org: Package Manager module documentation](https://www.drupal.org/docs/develop/core-modules-and-themes/core-modules/package-manager-module) - [Drupal CMS documentation: Updating Drupal](https://project.pages.drupalcode.org/drupal_cms/updates/intro/) - [Drupal CMS documentation: Updating Drupal core](https://project.pages.drupalcode.org/drupal_cms/updates/core/) - [Drupal.org: Drupal CMS Basics project page](https://www.drupal.org/project/drupal_cms_site_template_base) ## Questions about Automatic Updates ### Is Automatic Updates part of Drupal core? No. On 26 October 2026 the project page describes it as a contributed module that must be installed with Composer, developed as a future feature for Drupal core. Its engine, Package Manager, is in core 11.4 as an experimental module that is hidden in the module list. Automatic Updates 4.x depends on that core module. ### Can Automatic Updates update contributed modules and themes? Release 4.1.0 (20 January 2026) merged the Extensions sub-module into the main module, so core and extension updates share one page. The project page still calls extension updates experimental and under heavy development, and not ready for production. ### Does it handle minor or major Drupal upgrades? Minor-version core updates are disabled by default and can only be enabled programmatically, according to the project page. Major-version upgrades are not supported. Drupal CMS says its update screen handles core patch updates only. ### Does it work on every hosting platform? No. The codebase, including `vendor`, must be writable, so the Package Manager help calls it incompatible with some hosting platforms. It also needs Composer 2.7 or later in the 11.4.10 source, `rsync` and `proc_open()`, and it does not support multisite. ## Cite this definition "Automatic Updates." DXPR Drupal glossary, https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/automatic-updates. Last updated October 26, 2026. Copy ## Related terms - [Update](/hc/documentation/learn-drupal/drupal-glossary/update) - [Composer](/hc/documentation/learn-drupal/drupal-glossary/composer) - [Security update](/hc/documentation/learn-drupal/drupal-glossary/security-update) - [Cron](/hc/documentation/learn-drupal/drupal-glossary/cron) - [Project Browser](/hc/documentation/learn-drupal/drupal-glossary/project-browser) - [Drupal CMS](/hc/documentation/learn-drupal/drupal-glossary/drupal-cms) [All Drupal terms from A to Z](/hc/documentation/learn-drupal/drupal-glossary)