Managed Updates

Managed Updates offerings and requirements for Drupal 8 compatibility

Discuss in our Forum Discuss in Slack

Managed Updates is a service offered by our Professional Services team. We help keep your site updated so you can focus on what's important. Learn more about Managed Updates in the Managing Updates for WordPress and Drupal webinar

With Pantheon Managed Updates (PMU), you get:

  • CMS core updates
  • Module / plugin updates
  • Visual Regression Testing (VRT)

To make Managed Updates available to customers of all sizes and needs, Pantheon offers three versions: Premium, Lite, and Portfolio Upstreams.


Managed Updates Premium is for standalone sites and includes support for custom workflows, testing, and CI/build processes. Premium also offers personalized update issue remediation, and email notifications when updates are scheduled.


Managed Updates Lite is for standard sites on Pantheon, and offers basic CMS and plugin updates (with visual regression testing) on a customizable schedule. It's for WordPress or Drupal 7 sites that use the standard Pantheon WebOps workflow, or Drupal 8 sites using a Composer-build workflow without continuous integration processes (see below for details).

Portfolio Upstreams

Managed Updates for Portfolio Upstreams provides provides core, plugin, and module updates for customers managing site collections using Custom Upstreams.


  • Sites use Pantheon’s update workflow
    • Codebase changes are pushed to client's remote repo and then applied to each of the sites
    • Build step does not rely on 3rd party sources
    • No other special deployment instructions
  • Drupal 7 or WordPress 5.4 or above

Product Comparison Table

FeatureDescriptionManaged Updates Portfolio UpstreamsManaged Updates LiteManaged Updates Premium
Core, plugin, and module updatesFull code updates from publicly accessible repositories and sources.
Regular update detectionDaily scans of official repositories to detect when updates are available.
Visual Regression TestingVRT for every environment through which changes are deployed.
Custom deployment schedulingAdjustable scheduling for the deployment of core, plugin, and module updates.
Standalone sitesMaintenance of logically distinct and/or customized sites.
Workflow customizationSupport for bespoke site update workflows.
Remote pull requests to external repositoriesReceive pull requests for successful updates that can be accepted at your convenience.
Personalized update issue remediationExpert support for remediating update and deployment issues.
Headless site supportUpdates for headless and decoupled sites.
Composer compatibility support (Drupal 8)Updates for Composer-built Drupal sites.N/A
Custom build/CI processUpdates for sites using custom CI or build processes.
Patched code supportPreserves patched code in applied updates.Test and Deploy OnlyDrupal 7 sites excluded
Custom VRTVRT for authenticated pages or custom DOM elements.

Requirements and Steps for Drupal 8 Compatibility

In order to be supported by Pantheon Managed Updates, Drupal 8 sites should be in a "Composer-clean" state. This requires making sure the site’s codebase meets several criteria.


A Drupal 8 site using Managed Updates must:

  • have build and deployment handled by Pantheon, not by an external CI/CD service,

  • not include a pantheon.upstream.yml file in the codebase (unless it’s custom upstream), only pantheon.yml,

  • use a nested docroot structure,

  • be connected to the "Empty drupal8" Pantheon upstream ,

  • have a code-structure based on the Composer Drops-8 Example project.


  • Drupal core must be required as "drupal/core-recommended" package, not "drupal/core.".

  • All Drupal modules should be required by Composer (via composer.json).

  • Drupal core, themes, and modules should be locked to the exact versions currently installed on the Live environment. In composer.json, the "require" section should look like this for Drupal packages:


    "drupal/module": "1.2",
    "drupal/core-recommended": "8.8.0"


    "drupal/module": "~1.2",
    "drupal/module2": ">=1.2",
    "drupal/core-recommended": "^8.8"
  • Drush 9 or greater should be required by composer.json.

  • Custom modules should be stored in web/modules/custom.

  • Custom themes should be stored in web/themes/custom.

  • Local patches should be sourced from the patches directory in the project root.

  • After removing the vendor directory, composer.lock file, web/modules/contrib/*, web/themes/contrib/*, and web/core/*, running composer install should run with exit status 0 (no errors).

  • Composer-specific files and directories SHOULD NOT be included in the .gitignore file.

  • There should be no .git folders in the modules or vendors directories.

  • "topfloor/composer-cleanup-vcs-dirs": "^1.0" should be required in the top-level composer.json file.

See Also