This article assumes you installed Drupal with a composer project like drupal/core-recommended or drupal/dxpr-marketing-cms-project

List available Drupal updates

composer outdated "drupal/*"

If there is no line starting with drupal/core, Composer isn't aware of any update. If there is an update, continue with the commands below

Create a backup of your Drupal instance

When updating a production website, always create a backup before doing an update, even if have successfully tried the update on a development or test environment. Use your hosting provider's tools to create a backup or snapshot of your Drupal site.

Update Drupal core code

if you are using drupal/core-recommended:

composer update "drupal/core-*" --with-all-dependencies

To simulate the update, and show you what would happen, without actually changing anything, add --dry-run.

Update to the latest patch version of core

If you want to update your site to the latest patch version, but not the latest minor version, then add --with= options for each drupal/core-* dependency listed in composer.json.

For example, if 10.2 is the current minor version and you want to update your site to the latest patch version of 10.3:

composer update "drupal/core-*" --with-all-dependencies --with=drupal/core-recommended:~10.3.0 --with=drupal/core-composer-scaffold:~10.3.0

This example assumes that  drupal/core-recommended and drupal/core-composer-scaffold are the only Drupal core dependencies in composer.json.

Update to a specific version of core

In general, we recommend that you do not specify a specific version of Drupal core when updating, unless you know that you want to pin to a specific version. If you do want to pin your site to a specific version, you can use the following example: 

To pin your site to version 10.3.6 and update all dependencies accordingly: 

composer require drupal/core-recommended:10.3.6 drupal/core-composer-scaffold:10.3.6 drupal/core-project-message:10.3.6 --update-with-all-dependencies

Warning: If you pin your site to a specific core version, that version will be added to the lock file, and future updates will not go past this version. Re-run the require command as specified below to return to an 'unpinned' version of core.

Unpinning from a specific version of core

If you are running a pinned version of Drupal core, and want to update your site to another version, you have two choices.

  1. You can run the composer require command above to specify a new, pinned version of core. 
  2. You can unpin your core version, and update to the latest version of Drupal.

To unpin your version of Drupal, run this command: 

composer require drupal/core-recommended drupal/core-composer-scaffold drupal/core-project-message --update-with-all-dependencies

Run database updates

For convenience we included the Drush commands necessary to complete an update, many people find Drush quicker and easier than the web-based admin area.

You can either use drush:

drush updatedb
drush cache:rebuild

Or you can visit [YOUR DOMAIN]/update.php in a browser.