PHPackages                             metadrop/drupal-updater - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. metadrop/drupal-updater

ActiveLibrary[Utility & Helpers](/categories/utility)

metadrop/drupal-updater
=======================

Update drupal project dependencies

1.15.1(6mo ago)2474.7k↓32%5[5 issues](https://github.com/Metadrop/drupal-updater/issues)1PHP

Since Feb 22Pushed 6mo ago7 watchersCompare

[ Source](https://github.com/Metadrop/drupal-updater)[ Packagist](https://packagist.org/packages/metadrop/drupal-updater)[ RSS](/packages/metadrop-drupal-updater/feed)WikiDiscussions 1.x Synced 1mo ago

READMEChangelog (10)Dependencies (4)Versions (41)Used By (1)

Drupal updater
==============

[](#drupal-updater)

Drupal updater helps you to update the drupal modules of your site.

It does an update of all your drupal modules and dependencies defined in the composer.json.

It also allows update only securities.

Requirements
------------

[](#requirements)

This package works with:

- Drush >=10.
- Composer 2.4 (global).

Or alternatively, you can run it inside tools like [ddev](https://ddev.com).

Installation
------------

[](#installation)

Before doing the installation, make sure your environment has composer 2.4 or higher installed locally.

```
composer require metadrop/drupal-updater
```

Or, if you are using `ddev`:

```
ddev composer require metadrop/drupal-updater
```

Configuration
-------------

[](#configuration)

Configuration helps automating update workflows. All the parameters that are repeated through updates can be added to a configuration file to just launch `drupal-updater`, saving time adding the parameters manually, or doing custom helpers in local / ci environments.

There is a template with configuration ready to use at **vendor/metadrop/drupal-updater/drupal-updater.yml.dist**, to use it just copy it to the root:

```
cp vendor/metadrop/drupal-updater/.drupal-updater.yml.dist .drupal-updater.yml

```

The file .drupal-updater.yml at root is the default path, but it is possible to override configuration path by using the **--config** parameter:

```
drupal-updater --config .drupal-updater.securities.yml

```

Edit .drupal-updater.yml to setup custom parameters when needed.

### Configuration variables

[](#configuration-variables)

The following variables can be setup through .drupal-updater.yml

- **author**: Commits author
- **noDev**: Set to true to only update packages deployed in production.
- **onlySecurities**: Set to true to only update securities.
- **packages**: Allows specify which packages will be updated.
- **limit**: Limit the number of direct packages to update in each drupal-updater run. Can't be combined with packages.
- **environments**: Array list of environments to update.

How it works
------------

[](#how-it-works)

This module will try to update your dependencies based on how they are required in the composer.json.

- Before starting to update, all the Drupal configuration is consolidated and commited into GIT.
- For each module / package updated the changes are commited:
    - For PHP packages, it commits the composer.lock
    - For Drupal extensions, it applies the updates, commits the configuration changed and the modified files. On multisites environments it will export/commit the configuration for all environments keeping them all synchronized (see parameters).

If a package has an available update and that update can't be done by running `composer update`, it won't do the upgrade. This means that not all packages will be upgraded, but most of them yes.

Usage
-----

[](#usage)

Basic update:

```
./vendor/bin/drupal-updater update
```

Parameters allowed:

- **--config**: Specify where the configuration file is located.
- **--security**: It will update only securities.
- **--no-dev**: It won't update dev dependencies, only the primary ones.
- **--author**: It sets the git commits author. Example: `Test`
- **--environment**: List of sites (drush alias) to be run on Drupal Multisites. The drush alias must be local.
- **--packages**: Update only the mentioned packages. **--limit**: Limit the number of direct packages to update in each drupal-updater run. Can't be combined with packages.

Examples:

- Update securities:

    ```
    ./vendor/bin/drupal-updater --security
    ```
- Update only primary packages:

    ```
    ./vendor/bin/drupal-updater --no-dev
    ```
- Update specific packages:

    ```
    ./vendor/bin/drupal-updater --packages=drupal/core-recommended,drupal/core-dev
    ```
- Update with a specific author:

    ```
    ./vendor/bin/drupal-updater --author=Test
    ```
- Update on multiple sites (Drupal Multisite):

    ```
    ./vendor/bin/drupal-updater --environments=@site1.local,@site2.local,@site3.local,@site4.local
    ```

### DDEV

[](#ddev)

If you are using `ddev`, you can just run the commands above prepending `ddev exec`.

Example:

```
ddev exec ./vendor/bin/drupal-updater --security
```

###  Health Score

48

—

FairBetter than 95% of packages

Maintenance62

Regular maintenance activity

Popularity41

Moderate usage in the ecosystem

Community20

Small or concentrated contributor base

Maturity57

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 94.6% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~26 days

Recently: every ~72 days

Total

39

Last Release

200d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/3202817?v=4)[Omar Mohamad - El Hassan Lopesino](/maintainers/omarlopesino)[@omarlopesino](https://github.com/omarlopesino)

---

Top Contributors

[![omarlopesino](https://avatars.githubusercontent.com/u/3202817?v=4)](https://github.com/omarlopesino "omarlopesino (105 commits)")[![fjgarlin](https://avatars.githubusercontent.com/u/898540?v=4)](https://github.com/fjgarlin "fjgarlin (2 commits)")[![albeortev](https://avatars.githubusercontent.com/u/46744901?v=4)](https://github.com/albeortev "albeortev (1 commits)")[![jorgetutor](https://avatars.githubusercontent.com/u/1230268?v=4)](https://github.com/jorgetutor "jorgetutor (1 commits)")[![rsanzante](https://avatars.githubusercontent.com/u/776453?v=4)](https://github.com/rsanzante "rsanzante (1 commits)")[![zengenuity](https://avatars.githubusercontent.com/u/1405821?v=4)](https://github.com/zengenuity "zengenuity (1 commits)")

---

Tags

composerdrupaldrushmaintenance-scripts

### Embed Badge

![Health badge](/badges/metadrop-drupal-updater/health.svg)

```
[![Health](https://phpackages.com/badges/metadrop-drupal-updater/health.svg)](https://phpackages.com/packages/metadrop-drupal-updater)
```

###  Alternatives

[symfony/maker-bundle

Symfony Maker helps you create empty commands, controllers, form classes, tests and more so you can forget about writing boilerplate code.

3.4k111.1M568](/packages/symfony-maker-bundle)[symplify/monorepo-builder

Not only Composer tools to build a Monorepo.

5205.3M82](/packages/symplify-monorepo-builder)[shlinkio/shlink

A self-hosted and PHP-based URL shortener application with CLI and REST interfaces

4.8k4.3k](/packages/shlinkio-shlink)[shivas/versioning-bundle

Symfony application versioning, simple console command to manage version (with providers e.g. git tag) of your application using Semantic Versioning 2.0.0 recommendations

1121.2M1](/packages/shivas-versioning-bundle)[overtrue/php-opencc

中文简繁转换，支持词汇级别的转换、异体字转换和地区习惯用词转换（中国大陆、台湾、香港、日本新字体）。基于 \[BYVoid/OpenCC\](https://github.com/BYVoid/OpenCC) 数据实现。

12130.7k](/packages/overtrue-php-opencc)[shyim/danger-php

Port of danger to PHP

8544.9k](/packages/shyim-danger-php)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)