I've previously used Drush to update my Drupal-installations. They are installed without using Composer, and currently on version 8.7.3. However, when I try to use Drush (drush v8.1.15, using drush up) to install the currently newest version the update fails when untarring the new core. When googling I see conflicting answers about what to do - among suggestions are Drush9, updating using composer (which I tested - does not work since the page is not installed using Composer) and others. What would be the simplest, least likely way to destroy the page while being able to update (with regards to security updates)?

  • 3
    Rebuild your site locally using Composer. Then update locally using Composer. Then upload the updated packages to your live site and run database updates.
    – leymannx
    Sep 15, 2019 at 11:55
  • 1
    Latest releases of Drupal 8 work with Drush 9 only. There is a project out there that will convert your site to be composer controlled if that’s what you desire.
    – Kevin
    Sep 15, 2019 at 12:28
  • I would prefer to not go the composer-route if it is not needed - but if that is what I have to do to get security updates I guess I will. Looks like updating Drush could work though. Sep 15, 2019 at 20:59

2 Answers 2


The latest releases of Drupal 8 are "supported but not recommended" on Drush 8. Drush 8 is still necessary if you are not using Composer to build your site. Composer is recommended for all Drupal 8 sites because sooner or later you are likely to need a module that requires Composer. If your site does not yet need such a module, though, then it is possible to continue to use Drush 8 and the pm-update command.

A few months back drupal.org changed all of the URLs used to download Drupal images; in order to continue to use Drush 8, you need the latest version, which has been updated to use the new URL scheme. Please update to Drush 8.3.0, and you should be fine.

  • Thanks for this! I updated drush to 8.3.0 now - but still get the error. However, looks like the initial failed download is cached, but I can't seem to find a way to clear the cache? Sep 15, 2019 at 21:00
  • Nevermind - cleared the cache manually - still got an error. That error was caused since the droplet had ran out of Inodes. 8.3.0 worked like a charm. :) Sep 15, 2019 at 21:43

I am sure many expert users will consider this heretical advice. It may or may not work for you depending on your hosting arrangements.

I'm with a shared hosting provider using a cpanel interface. Their cpanel has the Softaculous installer.

I have found that I can simply update drupal core using their scripts in 1 click.

No drush. No Composer. No fuss.

Of course it does not update contrib modules (which can still be updated using the admin/modules/update interface) or libraries (which would need to be updated manually) but I have found this route way less stressful and complex with the relatively simple sites I am working with.

Pro developers of course need more sophisticated tools and more time efficient ways of updating multiple sites, and the manual route does take longer if you are updating multiple libraries.

I hope those developers so enamored with Composer don't kill off that functionality once they hear of this! (Please don't :-))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.