There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff.


$ drush dl drupal-7.32
It's forbidden to download drupal core into an existing core.

This one works:

$ drush up

But that's not what I want now.

How can I only upgrade core to latest version?

drush up drupal is not sufficient on its own: (Sorry about the Dutch. You'll get the gist.)

$ drush up drupal
Controle of updategegevens beschikbaar zijn ...                                                            [ok]
Update information last refreshed: di, 10/14/2014 - 20:57

Update status information on all installed and enabled Drupal projects:
 Naam                               Geïnstalleer  Proposed     Status
                                    de versie     version
 Administration menu (admin_menu)   7.x-3.0-rc4   7.x-3.0-rc4  Actueel
 Drupal                             7.31          7.31         Actueel
 Chaos tools (ctools)               7.x-1.4       7.x-1.4      Actueel
 Service links (service_links)      7.x-2.2       7.x-2.2      Actueel
 Entity API (entity)                7.x-1.5       7.x-1.5      Actueel
 Google Analytics                   7.x-2.0       7.x-2.0      Actueel
 Localization update (l10n_update)  7.x-1.0       7.x-1.0      Actueel
 Module filter (module_filter)      7.x-1.8       7.x-1.8      Actueel
 Pathauto (pathauto)                7.x-1.2       7.x-1.2      Actueel
 Redirect (redirect)                7.x-1.0-rc1   7.x-1.0-rc1  Actueel
 Token (token)                      7.x-1.5       7.x-1.5      Actueel
 Views (views)                      7.x-3.8       7.x-3.8      Actueel
 Webform (webform)                  7.x-3.20      7.x-3.21     Nieuwe versie beschikbaar

No code updates available.

3 Answers 3


In this case, it looks like you need to do

drush rf    # pm-refresh

before you do

drush up drupal

This will refresh the list of available updates so Drush knows there is a new release for Drupal.

  • 1
    thank you. I have tried with drush cc, but clearing the drush cache seems to not cancel this cached release info. drush rf did the job.
    – Antonello
    Commented Oct 15, 2014 at 17:56

Worth mentioning is

$ drush up --security-only

Only update modules that have security updates available.

That includes Drupal core.

drush up drupal

Appending the project you want to update makes drush to only update that project.

  • On some sites drush up drupal and drush up drupal-7.32 both fail at doing what I want. So I have to revert to drush up -y anyway.
    – the
    Commented Oct 15, 2014 at 16:57
  • I've tested the command on one of my local setups. Core is updated but modules are not. As you say, your sites may have something strange. Post your drush command output and we may see what0s wrong. Just update your question.
    – sanzante
    Commented Oct 16, 2014 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.