After migrating to the Pantheon platform, the responsibility of keeping Drupal core of the site up to date has shifted to the site owner.
According to the USM Security policy each site should be updated with any security patches in a timely manner. Drupal.org’s general policy is to release scheduled security patches on the third Wednesday of every month, therefore it is imperative for site owners to regularly check for security releases and deploy them to their Live environment.
Pantheon has helped to ease this burden with two features: AutoPilot and Check Now.
Pantheon has provided the “AutoPilot” feature which checks for and updates all Drupal modules, including the core, using integrated composer. AutoPilot also performs visual regression testing, and then finally merges the code into the site’s Development environment if no issues have been found. AutoPilot is configured to run every 7 days, therefore it may be up to seven days after a new version is released before AutoPilot runs and merges updates of Drupal modules into the Development environment.
DIT will ensure that AutoPilot is configured and runs successfully in Development, engaging Pantheon support as needed. Site owners should regularly deploy updates from Dev to Test and Live to ensure that Drupal core and modules are kept up-to-date.
Within the site dashboard in the Development environment in the Code section will be a link/button labeled Check Now to check for any new module and core updates. This is a manual check of Drupal core and module updates that can be initiated by site owners ahead of the weekly AutoPilot run.
If there are any updates they can be applied to the Development environment by clicking on the yellow link/button labeled Apply Updates, and then deploying to the Test and Live environments after you have confirmed your site’s functionality.