In the past (Drupal 7), security-only update via drush was simple as:

drush up --security-only

now, Drush 9.3 returns:

Command "up" is ambiguous.
Did you mean one of these? ...

composer does not help either:

composer outdated drupal/*

returns nothing.

In fact, my Drupal is outdated:

enter image description here

How can I update Drupal security updates via command line?

UPDATE (composer prohibits):

$ composer prohibits drupal/core:8.5.5
There is no installed package depending on "drupal/core" in versions not matching 8.5.5

1 Answer 1


It's all here Update core via Composer.

Short version, turn on maintenance mode

drush sset system.maintenance_mode 1

then run

composer update drupal/core --with-dependencies
drush updatedb
drush cr

Turn off maintenance mode

drush sset system.maintenance_mode 0

If you run the composer update command above but drupal/core is not updated, there might be another dependency holding back the Drupal upgrade. You can check for blocking dependencies using the command composer prohibits. For example, if you are trying to upgrade from 8.4.5 to 8.5.0, you can run composer prohibits drupal/core:8.5.0, and it should give a list of dependencies blocking the upgrade. Update those dependencies along with drupal/core and it should work (e.g. composer update drupal/core symfony/* --with-dependencies).

  • 2
    If composer outdated drupal/* returns nothing, that won't do anything. I think it's likely the OP is running this in the web root, and not managing the site with Composer in the "proper" way. If that's true then their current project, the one at /composer.json, is drupal/core (well drupal/drupal strictly speaking), so there's nothing to update
    – Clive
    Commented Jul 5, 2018 at 10:03
  • @Clive could you please point to the "proper" way?
    – ohho
    Commented Jul 5, 2018 at 10:11
  • Something along these lines @ohho: drupal.org/docs/develop/using-composer/…
    – Clive
    Commented Jul 5, 2018 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.