Keeping Drupal Current with AI: Automating Core and Module Updates at the Speed of Change
Institutions that manage multiple Drupal installations face a persistent maintenance challenge: Drupal core and contributed modules are updated frequently, and without a reliable process for managing those updates, sites can quickly fall behind. Weekly security releases, dependency changes, and module updates all require attention. When teams do not have enough bandwidth to keep up, the result can be increased security risk, technical debt, and larger upgrade problems later.
At the University of San Francisco, our Web Services team experienced this directly. Our Drupal sites fell behind by two major versions. Drupal 11 had already been released while our sites were still on Drupal 9.5. Moving forward required far more than simply running Composer updates. We had to work through bugs, dependency conflicts, integration issues, and compatibility problems, especially where custom applications had been built on top of Drupal.
This is a common situation for internal teams. Web services groups are often responsible for new feature work, content support, accessibility, integrations, production issues, and stakeholder requests. Regular core and module maintenance can become difficult to prioritize until the gap becomes urgent. When an organization lacks internal capacity, specialized expertise, or the budget to outsource, Drupal maintenance can become reactive instead of routine.
Our approach is to use AI as a force multiplier in the Drupal update process. AI can help identify available updates, interpret dependency conflicts, propose fixes, review custom code impacts, and assist developers in moving through upgrade tasks more efficiently. Instead of replacing developer judgment, AI helps reduce the amount of repetitive investigation and troubleshooting required to keep sites current.
The next stage, and one we are now using, is an automation process that checks Drupal sites, installs core and module updates, conducts smoke tests, and deploys changes to a staging environment where humans can test and review. This kind of automation is especially important for organizations that still rely on a more traditional hands-on maintenance process. Automated smoke tests can increase confidence, identify obvious failures earlier, and shorten the turnaround time for Drupal updates.
Adaptability is one of AI’s strongest advantages in this workflow. Each Drupal site is different. Sites may have different contributed modules, themes, integrations, content structures, deployment processes, and custom applications. AI can adapt to those differences and help apply a consistent update process across multiple installations while still accounting for the specific needs of each site. With a regular deployment schedule, teams can move from occasional large upgrade efforts toward smaller, more manageable update cycles.
However, using AI for this kind of work also introduces real risks. AI should not be treated as an unchecked automation layer, especially when it is modifying configuration, dependencies, or deployment workflows. In our own process, we found that AI attempted to push configuration files containing API keys. That created a security concern and reinforced the need for clear institutional policies around secrets, configuration, and code review.
This is where policy becomes essential. Teams need to define what AI is allowed to change, what it must never commit, how secrets should be handled, what testing is required, and when human approval is mandatory. In the case of API keys and credentials, our policy is that sensitive values should not live in committed configuration files. They should be managed through environment variables or approved secrets-management practices.
AI is highly adaptable, but it adapts to the guidance it is given. If an organization wants to use AI in a recurring automation task, the automation must include clear instructions about institutional policies, security expectations, coding standards, review requirements, and deployment rules. The more explicit the policy, the safer and more predictable the AI-assisted workflow becomes.
This session will also share practical tips for using AI safely in Drupal maintenance. Teams should always understand what AI is changing before accepting its work. AI should be asked to provide detailed reports when it addresses integration issues, fixes bugs, changes dependencies, or modifies configuration. Those reports help developers review the work more effectively and create accountability in the update process.
The goal is not to remove humans from Drupal maintenance. The goal is to make maintenance more sustainable. With AI-assisted automation, internal teams can reduce repetitive work, catch issues earlier, improve update velocity, and keep Drupal installations more secure and current. For organizations that previously had to build around outdated Drupal versions because they lacked time, expertise, or budget, AI creates a new path forward.
In conclusion, AI automation can be transformative for Drupal core and module updates, but only when paired with strong human oversight and clear institutional policy. At the University of San Francisco, our Web Services team is using AI to help move from reactive upgrades toward a more regular, automated, and secure maintenance process. This session will share what we have learned, where AI has helped, where caution is needed, and how other Drupal teams can begin building safer AI-assisted update workflows of their own.
At the University of San Francisco, our Web Services team experienced this directly. Our Drupal sites fell behind by two major versions. Drupal 11 had already been released while our sites were still on Drupal 9.5. Moving forward required far more than simply running Composer updates. We had to work through bugs, dependency conflicts, integration issues, and compatibility problems, especially where custom applications had been built on top of Drupal.
This is a common situation for internal teams. Web services groups are often responsible for new feature work, content support, accessibility, integrations, production issues, and stakeholder requests. Regular core and module maintenance can become difficult to prioritize until the gap becomes urgent. When an organization lacks internal capacity, specialized expertise, or the budget to outsource, Drupal maintenance can become reactive instead of routine.
Our approach is to use AI as a force multiplier in the Drupal update process. AI can help identify available updates, interpret dependency conflicts, propose fixes, review custom code impacts, and assist developers in moving through upgrade tasks more efficiently. Instead of replacing developer judgment, AI helps reduce the amount of repetitive investigation and troubleshooting required to keep sites current.
The next stage, and one we are now using, is an automation process that checks Drupal sites, installs core and module updates, conducts smoke tests, and deploys changes to a staging environment where humans can test and review. This kind of automation is especially important for organizations that still rely on a more traditional hands-on maintenance process. Automated smoke tests can increase confidence, identify obvious failures earlier, and shorten the turnaround time for Drupal updates.
Adaptability is one of AI’s strongest advantages in this workflow. Each Drupal site is different. Sites may have different contributed modules, themes, integrations, content structures, deployment processes, and custom applications. AI can adapt to those differences and help apply a consistent update process across multiple installations while still accounting for the specific needs of each site. With a regular deployment schedule, teams can move from occasional large upgrade efforts toward smaller, more manageable update cycles.
However, using AI for this kind of work also introduces real risks. AI should not be treated as an unchecked automation layer, especially when it is modifying configuration, dependencies, or deployment workflows. In our own process, we found that AI attempted to push configuration files containing API keys. That created a security concern and reinforced the need for clear institutional policies around secrets, configuration, and code review.
This is where policy becomes essential. Teams need to define what AI is allowed to change, what it must never commit, how secrets should be handled, what testing is required, and when human approval is mandatory. In the case of API keys and credentials, our policy is that sensitive values should not live in committed configuration files. They should be managed through environment variables or approved secrets-management practices.
AI is highly adaptable, but it adapts to the guidance it is given. If an organization wants to use AI in a recurring automation task, the automation must include clear instructions about institutional policies, security expectations, coding standards, review requirements, and deployment rules. The more explicit the policy, the safer and more predictable the AI-assisted workflow becomes.
This session will also share practical tips for using AI safely in Drupal maintenance. Teams should always understand what AI is changing before accepting its work. AI should be asked to provide detailed reports when it addresses integration issues, fixes bugs, changes dependencies, or modifies configuration. Those reports help developers review the work more effectively and create accountability in the update process.
The goal is not to remove humans from Drupal maintenance. The goal is to make maintenance more sustainable. With AI-assisted automation, internal teams can reduce repetitive work, catch issues earlier, improve update velocity, and keep Drupal installations more secure and current. For organizations that previously had to build around outdated Drupal versions because they lacked time, expertise, or budget, AI creates a new path forward.
In conclusion, AI automation can be transformative for Drupal core and module updates, but only when paired with strong human oversight and clear institutional policy. At the University of San Francisco, our Web Services team is using AI to help move from reactive upgrades toward a more regular, automated, and secure maintenance process. This session will share what we have learned, where AI has helped, where caution is needed, and how other Drupal teams can begin building safer AI-assisted update workflows of their own.