Introduction
We've all been there—facing an endless cycle of Drupal updates that require development, testing, and deployment. This phenomenon even has a name: "Drupal Update Fatigue". But why does Drupal update so frequently? To answer that, we need to explore how Drupal is structured and the nature of open-source software development.
The Structure of Drupal
Drupal Core forms the foundation of every Drupal website and encapsulates the essential qualities of Drupal such as security, stability, scalability, resilience, and performance. It utilises other open-source technologies like PHP and Symfony, and its development is guided by a small team of trusted Core maintainers who focus their efforts on value-added features. Core is intentionally lean, including only key Core modules, such as user management, and intentionally excluding many of the features required for a fully functional website.
To extend Core’s capabilities, there are over 50,000 contributed (Contrib) modules, which are created and developed independently of Drupal Core by module maintainers who decide what changes to include in the next version and the direction of development. A typical corporate website would use over 100 Contrib modules, along with some Core modules. On top of that, Custom modules are created by developers for requirements unique to a specific website. They mean you don’t need to wait for the owners of the software to decide whether to add that feature to the product, as you would with proprietary software.
Drupal Core and the provision of Core, Contrib and Custom modules makes Drupal extensible and customisable. The combination of modules and how they are configured, means every Drupal website is unique. Drupal stopped being a simple Content Management System (CMS) many years ago and has become a framework for creating bespoke CMS solutions tailored to specific requirements.
Thousands of contributors worldwide dedicate their time to improving Drupal Core, Core modules and Contrib modules. Some contribute independently, while others benefit from employer support, incentivised on the one hand with a desire to make Drupal better and, since 2015, through Drupal’s credit system. Credits act as recognition for individuals and determine a Drupal agency’s ranking on the official list of Drupal Certified Partners. Zoocha is proud to hold Platinum Certification, placing us among the top three UK-based Drupal agencies.
An Open-Source Philosophy
Given the immense effort that has gone into developing and maintaining Drupal over its 24-year history, you might expect it to come with a hefty price tag. Yet, Drupal remains completely free, and it always will be. Drupal Core and Contrib modules are freely available for download.
Drupal's commitment to open-source is beyond admirable; it operates under an open web manifesto built on freedom, defined by decentralisation, thriving on inclusion, requiring participation and existing for empowerment. The community-driven nature of Drupal ensures continuous improvement and resilience. Supporting agencies that actively contribute to Drupal's development are essential, as highlighted by Drupal’s founder, Dries Buytaert, in his 2024 article Balancing Makers and Takers to scale and sustain Open Source:
“Makers directly invest in growing both their business and the Open Source project. Takers are solely focused on growing their business and let others take care of the Open Source project they rely on.”
When you engage Zoocha to build a Drupal website, you’re investing in our expertise in designing, configuring, customising, hosting, deploying, and managing your project, as well as the future of Drupal. With over 16 years of experience, the Zoocha team has a deep passion for Drupal and a commitment to its continued development.
If you don’t choose us, we do urge you to pick a partner demonstrably dedicated to the tools they use from the list of Drupal Certified Partners operating within the UK.
Understanding Updates vs. Upgrades
Drupal has moved to semantic version numbering (although some Contrib modules still use an older version numbering system). Any given release is identified by a version number in the form major.minor.patch. At the time of writing, the current version of Drupal Core is 11.1.3.
An update involves moving from one minor version to the next, such as from Drupal 11.1 to 11.2. Drupal Core updates occur approximately every six months, with each minor version receiving support for about a year. More minor patches are released as required.
Contrib module updates can happen at any time and they vary depending on the module maintainers. Updates may enhance performance, resilience, design, accessibility, and user experience, or introduce new features.
An upgrade, on the other hand, is a more significant change. For Contrib modules, it might involve major restructuring, major new features, breaking changes, or suggest a difficult upgrade path.
Drupal Core upgrades occur approximately every two years, and represent a major new version of Drupal, often coinciding with fundamental changes in underlying technologies such as PHP or Symfony. Major functional improvements and code deprecations will accompany Core upgrades.
So Why All The Updates?
Outside of strategic initiatives that govern the broad direction of Drupal, Drupal’s development is driven by the maintainers of Core and Contrib modules and the desire for constant improvement. Development is actively incentivised through credits to encourage that improvement. Given the distributed nature of development, updates to Drupal Core and Contrib modules occur frequently. If you updated a typical Drupal website today, within a day or two, new updates would likely be available for one or more of its components.
While non-security updates don’t need to be deployed immediately, keeping up with updates is a best practice. Regular updates help avoid incompatibility issues, ensure any critical security patches can be applied quickly, and make it easier to prepare for major version upgrades.
Security Through Transparency
Drupal’s frequent security updates might suggest it's an insecure platform, but the opposite is true. The open-source nature of Drupal and its open-source dependencies, means its code is visible to all; friend or foe alike. The Drupal Security Working Group, alongside the global Drupal community, actively searches for vulnerabilities. Patches are developed and tested before the details of security flaws are made public, allowing site owners to update their websites promptly.
Unlike proprietary software, which can rely on security through obscurity, Drupal remains secure through its transparent, community-driven approach.
To evidence this, Drupal 7 Core had just one security patch identified in its final 2 years of support.
Why Do Bugs Appear After Updates?
Updates are supposed to be improvements, so new bugs that appear after an update can be frustrating, and we understand why. The root cause often lies in the complexity of interoperability between Drupal Core and the numerous modules used on any given site. Despite thorough testing, conflicts can arise due to compatibility issues between specific combinations of modules or module configurations, or obscure and untested use cases.
A robust quality assurance process, including automated testing and user acceptance testing, can help mitigate these problems, but occasional bugs are an inevitable part of software development.
Conclusion
Drupal’s frequent updates are a direct result of its vibrant open-source community and commitment to continuous improvement. While updates may feel overwhelming, they ensure Drupal remains secure, performant, and adaptable. By being proactive with updates and planning strategic upgrades, website owners can expect a robust and future-proof Drupal website.
At Zoocha, we’re dedicated to making the update and upgrade process as seamless and painless as possible for our clients. Whether you need routine update maintenance, upgrading from an older version of Drupal, or a brand new Drupal website, our expertise and dedication to the open-source Drupal platform ensures you stay ahead in the ever-evolving world of Drupal.
Get in Touch
Struggling with a major upgrade or just keeping your Drupal site up to date? Get in touch with one of our team at [email protected] and we can help get you back on track.
About the author
Duncan has been an active member of the Drupal community since 2009. Beginning his journey as a back-end developer, he now plays a key role in our Client Services team, helping clients optimise their digital strategy from a technical perspective to maximise the value of their existing platforms. A DrupalCon Europe speaker, Duncan is deeply engaged in the Drupal ecosystem and enjoys collaborating with the wider community.