Managed Updates

Descriptions of the Managed Updates products and requirements for Drupal 8 compatibility


Managed Updates is a service offered by our Professional Services team. We help keep your site updated so you can focus on what's important. Learn more about Managed Updates in the Managing Updates for WordPress and Drupal webinar

With Pantheon Managed Updates, you get.

  • CMS core updates
  • Module / plugin updates
  • Visual Regression Testing (VRT)

To make Managed Updates available to customers of all sizes and needs, Pantheon offers three versions: Lite, Premium, and Portfolio Upstreams.


Managed Updates Lite is for standard sites on Pantheon, and offers basic CMS and plugin updates (with visual regression testing) on a customizable schedule. It's for WordPress or Drupal 7 sites that use the standard Pantheon WebOps workflow, or Drupal 8 sites using a Composer-build workflow without continous integration processes.(see below for details).


This more specialized service can handle sites with custom workflows, testing, and CI processes. It also offers personalized update issue remediation, and email notifications when updates are scheduled.

  • Patched code
  • Standalone sites

Portfolio Upstreams

Managed Updates for Portfolio Upstreams provides managed updates to all your client sites using your Custom Upstreams.

  • Uses Pantheon’s update workflow
    • Codebase changes are pushed to client's remote repo and then applied to each of the sites
    • Build step does not rely on 3rd party sources
    • No other special deployment instructions
  • Currently supports Drupal 7 or WordPress 5.4 or above.

Product Comparison Table

Managed Updates LiteManaged Updates PremiumManaged Updates Portfolio UpstreamsDescription
Core, Plugin and Module UpdatesCode updates from publicly accessible repositories and sources are included.
Regular Update DetectionDaily scans of official repositories to detect when updates are available.
Visual Regression TestingVisual regression testing for every environment through which changes are deployed.
Custom Deployment SchedulingFor use with individual sites (no Custom Upstreams or WP Site Networks).
Standalone Sites
Workflow CustomizationLite & Portfolio workflows cannot be customized.
Remote Pull Requests to external repositoriesPremium only: Pantheon can initiate pull requests to external repositories based on successful updates, that customers can accept at their own convenience.
Personalized Update Issue RemediationSupports customers who require additional assistance remediating identified issues.
Headless Site SupportHeadless sites may require additional front ends on the customer side to test against.
Composer Compatibility Support (For Drupal 8)N/AUse Premium for Composer built sites.
Custom build/CI processUse Premium to integrate Managed Updates with existing CI or build processes.
Patched Code SupportExcluded (Drupal 7)Test and Deploy Only
Custom Visual Regression TestingVRT for authenticated pages or custom DOM elements.

Requirements and Steps for Drupal 8 compatibility

In order to be supported by Pantheon Managed Updates, Drupal 8 sites should be in a "Composer-clean" state. This requires making sure that site’s codebase meets several criteria.


A Drupal 8 site using Managed Updates must:

  • have build and deployment handled by Pantheon, not by an external CI/CD service,

  • not include a pantheon.upstream.yml file in the codebase (unless it’s custom upstream), only pantheon.yml,

  • use a nested docroot structure,

  • be connected to the "Empty drupal8" Pantheon upstream .

  • have a code-structure based on the Composer Drops-8 Example project.


  • Drupal core shall be required as "drupal/core-recommended" package, not "drupal/core.".

  • All Drupal modules should be required by Composer (via composer.json).

  • Drupal Core, themes and modules should be locked to the exact versions currently installed on the Live environment. In composer.json, the "require" section should look like this for Drupal packages:


    "drupal/module": "1.2",
    "drupal/core-recommended": "8.8.0"


    "drupal/module": "~1.2",
    "drupal/module2": ">=1.2",
    "drupal/core-recommended": "^8.8"
  • Drush 9 or greater should be required by composer.json.

  • Custom modules should be stored in web/modules/custom.

  • Custom themes should be stored in web/themes/custom

  • Local patches should be sourced from the patches directory in the project root.

  • After removing the vendor directory, composer.lock file, web/modules/contrib/*, web/themes/contrib/*, and web/core/*, running composer install should run with exit status "0" (no errors).

  • Composer-specific files and directories SHOULD NOT be included into .gitignore file.

  • There should be no .git folders in the modules or vendors directories:

  • "topfloor/composer-cleanup-vcs-dirs": "^1.0" should be required in the top-level composer.json file.