Updates
Craft and plugin updates across every site
Manager collects the update position of every Craft site you manage once a day and shows it in one list. It tells you which updates are security releases and which will break on the way through. It does not install anything.
Fourteen days, no card. Craft CMS 5 and later.
Why update tracking goes wrong
A Craft security release is announced on a Thursday. It affects three of the forty sites you look after. Nobody is quite sure which three, so either everybody checks everything or the release sits unnoticed for nine days.
Checking by hand means opening each control panel, which is slow enough that it happens weekly at best, and it produces a number that is out of date by the time you have finished writing it down.
How updates are collected
-
The connector asks Craft
Once a day, the connector calls the same update service the Craft control panel uses. Manager never reaches into your site and never contacts Packagist on your behalf.
-
The answer is reduced to facts
Current version, latest version, how many releases behind, whether a security release sits between the two, and whether the next version is a breaking change. Per plugin, the same, plus whether the plugin is abandoned.
-
Release notes are dropped
There is no field for them in the schema. Release notes describe the unpatched vulnerability, and they do not belong in a dashboard next to the name of a site that has not been patched yet.
-
Checks are spread out
Each site runs its daily check at a jittered minute, so a fleet of forty does not arrive at Craft's update service in the same second.
-
You see it in one place
The fleet view groups by package, so you can answer "which sites need this" rather than "what does this site need".
What you get, and what you do not
Security releases flagged per site and per plugin
Taken from the critical release flag Craft itself publishes. An outstanding Craft security release opens a critical finding; a plugin one opens a high finding.
Breaking changes marked
Where the next available version crosses a breakpoint, the row says so, so a routine slot does not become a migration.
PHP end of life
The site reports its PHP version and Manager knows when that version stops receiving security fixes.
Abandoned plugins surfaced
A package the maintainer has walked away from is a decision waiting to happen, not an update.
Manager does not install updates
This is the product, not a gap in it. Installing requires filesystem write access and command execution on your servers, which is the credential we have gone to some trouble not to hold.
Nothing needs relaxing to use it
allowUpdates can stay off. Craft's update service still answers a check. Manager treats the updater being enabled in production as a low-severity finding of its own.
The outcome
On Monday morning you can answer what changed, what is outstanding and what is urgent across the fleet before the first client call, and apply the updates through your normal deployment pipeline.
Read how it works
The documentation lives in the public repository, next to the code it describes, and every page carries a link to edit it.
Related
-
Find the Craft sites that need attention first
Eighteen rules run against every report. Findings open with a severity, and close themselves when the site is fixed.
-
Craft and plugin licence status across the fleet
Editions, trials, expiries and domain mismatches, worked out on the site. Licence keys are never transmitted.
-
Alerts for the issues that need a person
Four events, by email or webhook, filtered by severity. Queued, so a slow endpoint never delays a site report.
See your whole fleet in about ten minutes
Add a site, install the connector with Composer, paste the one-time code. The first report arrives on the next run. Fourteen days free, no card, and nothing on your sites changes.
Craft CMS 5 and later. Read-only by default. AGPL-3.0-or-later.