On a Drupal 8 site, using the drupal-composer/drupal-project template, how would I go about updating only those modules which have a security release?

Our policy is to not update any module in our monthly maintenance routine unless it has a security update.

Ideally I'd like to find a solution which could be automated.

1 Answer 1


(I am using Drupal 7 modules as example, but just because there are more examples of security updates for Drupal 7 modules.)

Without custom coding, it's not possible. Drupal.org doesn't use a different name schema for security updates. From the version number you cannot know that version 7.x-3.14 of the Views module was a security update, while version 7.x-3.13 was not a security update.

That information is kept in https://updates.drupal.org/release-history/views/7.x, for the Drupal 7 version of the Views module, or in general in https://updates.drupal.org/release-history/<project short name>/<Drupal version>.
In the list of terms associated with a release, a Release type term whose value is Security update means the release is a security update.

  <name>views 7.x-3.14</name>
      <name>Release type</name>
      <value>Security update</value>
      <name>Release type</name>
      <value>Bug fixes</value>

The classes under the \Drupal\update namespace can help in writing the required code. UpdateProcessor::parseXml() is the method used to parse the XML data for a single project, but you would probably need to access one of the services Drupal implements.

  • Perfect, great answer. We'll be able to process the XML and figure out the release type. The option I had considered was using drush ups --security-only and then processing that output but this is cleaner.
    – tanc
    Dec 20, 2016 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.