Drupal upgrade the easy way

2018-04-25: Updated patch files to Drupal 7.59 and added SA-CORE-2018-004 patch for Drupal 6. Added links to Patches for Drupal 5.

Please note: Email notification may be disabled in the future because I plan to replace this site by static pages.

The standard procedure to upgrade Drupal to the latest release is to download it from drupal.org and follow the included UPGRADE.txt.

For administrators using the UNIX shell it may be easier using the attached patch files below instead of downloading and installing the newest complete Drupal release.

To patch your Drupal installation follow UPGRADING.txt up to and including

  • for Drupal 6: 5. Disable all custom and contributed modules.
  • for Drupal 7: 2. Go to Administration > Configuration > Development > Maintenance mode...

Now go on using this commands:

  • Dry run for testing without modifying anything: patch -p1 --dry-run < PATCHFILE
  • Do the real patching: patch -p1 < PATCHFILE

Your Drupal installation is now upgraded. proceed with UPGRADING.txt from

  • for Drupal 6: 9. Verify the new configuration file to make sure it has correct information.
  • for Drupal 7: 5. Re-apply any modifications to files such as .htaccess or robots.txt.

Note: Most important step after upgrading is to run update.php as described in UPGRADING.txt above.


If you get errors like Reversed (or previously applied) patch detected or 1 out of 2 hunks FAILED while running the patch dry run (second command above) immediately interrupt patching and upgrade following the steps explained in UPGRADING.txt.

Use this patch files on your own responsibility. I don't guarantee the proper function of the patch files on Drupal installations other than my own.

Note: If the patch process gets interrupted and leaves a mix of patched and unpatched files you may re-run it by ignoring already patched files after eliminating the reason of the interruption:

  • patch -p1 -N < PATCHFILE

You may savely remove reject files created during that process:

  • find . -name "*.rej" | xargs rm
Sometimes .htaccess and sites/default/default.settings.php got changes. Make sure you have a backup of your .htaccess before applying a patch. If you modified your .htaccess before the patch may not apply. In this case rename your .htaccess to .htaccess-mine and apply the patch. It will ask you which file to patch, just press ENTER. Now it asks if you want to skip this patch. Enter "y" and press ENTER. Rename .htaccess-mine back to .htaccess and apply the changes to .htaccess as described in the Release notes). Also have a look there what did change in the settings.php.

Patch files

Drupal 8

I recommend upgrading using Composer or Drush.

Drupal 7

To verify the integrity of the patch files use this MD5 hashes:

MD5 (drupal-7.0-to-7.59.patch) = 54851a61d1376193869b42bdaf12f8ba
MD5 (drupal-7.1-to-7.59.patch) = 4b07a27afff26d4186d8ea295df287ad
MD5 (drupal-7.2-to-7.59.patch) = 0aa728e803b7c2389d08b1a1bf31c4dd
MD5 (drupal-7.3-to-7.59.patch) = 52b0a90b1c4f5099fb3023a76a3e66f1
MD5 (drupal-7.4-to-7.59.patch) = dc49cfe9e2fec1976837e5d6fa2ead5b
MD5 (drupal-7.5-to-7.59.patch) = 7b384d38005570f10ccc7f1a8acbdba2
MD5 (drupal-7.6-to-7.59.patch) = c546397bd30e2e4118ce61ed276e9e09
MD5 (drupal-7.7-to-7.59.patch) = 4ec668588b3d3bf8825c6c100b7ea050
MD5 (drupal-7.8-to-7.59.patch) = 3eebb2e4c5a230fd85f77bb1bdb5ec37
MD5 (drupal-7.9-to-7.59.patch) = bc743ab58773becb7281785ce7d9dc37
MD5 (drupal-7.10-to-7.59.patch) = d670ba12db1d94ce0649f82a4bc09824
MD5 (drupal-7.11-to-7.59.patch) = 2c4c7374d52f47741c38b9626a9320e6
MD5 (drupal-7.12-to-7.59.patch) = 5b2e72358f85ea4b74d2f0b99c050392
MD5 (drupal-7.13-to-7.59.patch) = 9d599ab8d598b9deb64332b1ead49900
MD5 (drupal-7.14-to-7.59.patch) = 95dfcb63ff89ac4c91eb6177c82312c9
MD5 (drupal-7.15-to-7.59.patch) = 7a8c1bc384bb911d79003d15ba228830
MD5 (drupal-7.16-to-7.59.patch) = ec3f11b8a68d39c17c56f1f082a8a3c6
MD5 (drupal-7.17-to-7.59.patch) = aaa8167d53419d2e51c72f9cabadc9bf
MD5 (drupal-7.18-to-7.59.patch) = 1245e9d8a9bd88f68fd8cc43332ff835
MD5 (drupal-7.19-to-7.59.patch) = 19272a0af6947e0d7443948901e6374e
MD5 (drupal-7.20-to-7.59.patch) = 0fb2b7daf757f88250ecd1be6961088e
MD5 (drupal-7.21-to-7.59.patch) = 68f1f4cfa87b34774e46d09fa9498de8
MD5 (drupal-7.22-to-7.59.patch) = 5a7cab28c4b23bef4c63886579209623
MD5 (drupal-7.23-to-7.59.patch) = d316241d65803b51283e084690db5e77
MD5 (drupal-7.24-to-7.59.patch) = 645a51ae31c0f240f18ca0a9975c085a
MD5 (drupal-7.25-to-7.59.patch) = 7b0283b7d66e2538794ea7d0258a42d1
MD5 (drupal-7.26-to-7.59.patch) = 849e44e5ee1f2f78522ba724026a3d3d
MD5 (drupal-7.27-to-7.59.patch) = 06597d3c6f988b1fd2992d0ffbc365bc
MD5 (drupal-7.28-to-7.59.patch) = b24116427e1e4126655002f99950d4c2
MD5 (drupal-7.29-to-7.59.patch) = f8bf23ac1f8abca3d1037fe80c6c981d
MD5 (drupal-7.30-to-7.59.patch) = 628e1476f6523cb336f1ef3d1c04f48f
MD5 (drupal-7.31-to-7.59.patch) = b22d85c822165a3b82efb50ac7c20c7f
MD5 (drupal-7.32-to-7.59.patch) = 26f31a47b0030892062e942e9a662873
MD5 (drupal-7.33-to-7.59.patch) = d1ef5d7cda148715a2c252e9b70d1021
MD5 (drupal-7.34-to-7.59.patch) = 3b206642c96af70cdf8113b782e1852a
MD5 (drupal-7.35-to-7.59.patch) = 971671b90499d308959f06c6ca4765c4
MD5 (drupal-7.36-to-7.59.patch) = 97777151d2c7d9ec73ba5d0474a711a5
MD5 (drupal-7.37-to-7.59.patch) = 66ff068e9be9bc96895741cac4590992
MD5 (drupal-7.38-to-7.59.patch) = 82ca7f9c398df5bf5544ab7ea045ee5f
MD5 (drupal-7.39-to-7.59.patch) = 4b52918f5f9c737d11e2d743a3df1d26
MD5 (drupal-7.40-to-7.59.patch) = b3cd6ec4ef6f61e2e52f74490101dfb4
MD5 (drupal-7.41-to-7.59.patch) = 2a7db15176177c2a6527e85d1f73d8d5
MD5 (drupal-7.42-to-7.59.patch) = aec35f13d5f62b9e77489ef14948f7c7
MD5 (drupal-7.43-to-7.59.patch) = da7f8855ad0c2aa99cacd2a0ba880481
MD5 (drupal-7.44-to-7.59.patch) = b170a62d04d28ed94c67f1051e4c04b2
MD5 (drupal-7.50-to-7.59.patch) = c0c6275844ff61356fe3fa5f3c6d9ab3
MD5 (drupal-7.51-to-7.59.patch) = 5f1d6fba34588eac6afad1be8593efa1
MD5 (drupal-7.52-to-7.59.patch) = 40b47cab0bea62101410ff3e335400bd
MD5 (drupal-7.53-to-7.59.patch) = 7ec1f210a007d07bb85a4a58f5e54bdd
MD5 (drupal-7.54-to-7.59.patch) = c35f2b103ddd089bb65a8840a9262f92
MD5 (drupal-7.55-to-7.59.patch) = 21535c9df94427e61d9b07bb841c39c5
MD5 (drupal-7.56-to-7.59.patch) = dab878333263178b3c0e911cb887c0ff
MD5 (drupal-7.57-to-7.59.patch) = 3af98bc37981a9b28cf5334ca7d02b70
MD5 (drupal-7.58-to-7.59.patch) = 880b6231f78f9d1864523c7e27860b98

Drupal 6

To verify the integrity of the patch files use this MD5 hashes:

MD5 (drupal-6.0-to-6.38.patch) = 0d96eda6cfb02064b7c0f26f2d96db04
MD5 (drupal-6.1-to-6.38.patch) = dfa23ea8ec25666bedce705142d932f7
MD5 (drupal-6.2-to-6.38.patch) = 7e59144aa4b09a015a67679aab794dd6
MD5 (drupal-6.3-to-6.38.patch) = 5582de3f81efefc89951b9d28d5085c3
MD5 (drupal-6.4-to-6.38.patch) = f9ae77bbadf33f51fce316042d7195f5
MD5 (drupal-6.5-to-6.38.patch) = cb6370f9270eeea17bd8921585c4567f
MD5 (drupal-6.6-to-6.38.patch) = dc39e261e62a4788cdbd0088ccdbc1ae
MD5 (drupal-6.7-to-6.38.patch) = fab8b9dcd5765c553bea222b025c71ec
MD5 (drupal-6.8-to-6.38.patch) = cecaef557a5f4b7c66b637ad61c510e6
MD5 (drupal-6.9-to-6.38.patch) = 380f64ba07b2aa98466a703aa859cff1
MD5 (drupal-6.10-to-6.38.patch) = 6ddd550af5102ffab1c5770ce3c6b2af
MD5 (drupal-6.11-to-6.38.patch) = 1f5003ef05dc5af42773d1d8c51c72eb
MD5 (drupal-6.12-to-6.38.patch) = 41afac12d544a929eb0c3631e3df43c9
MD5 (drupal-6.13-to-6.38.patch) = 4f5a18b7f00674409f9dfd7b748a1f9d
MD5 (drupal-6.14-to-6.38.patch) = f86b7746b792e368953688a4fb6d25d5
MD5 (drupal-6.15-to-6.38.patch) = d8901736b33c9b02d6e49f93388ef1c7
MD5 (drupal-6.16-to-6.38.patch) = f06dd17e4d7400e5eba2383ecc6abd6c
MD5 (drupal-6.17-to-6.38.patch) = a251d5cc62922e81288f351fb6f0a9fc
MD5 (drupal-6.18-to-6.38.patch) = 00889048e2a3749cd6aa83f9685d754e
MD5 (drupal-6.19-to-6.38.patch) = 86993497e5d7ec660e7c7240abb56ed0
MD5 (drupal-6.20-to-6.38.patch) = 8d9bcd3ec3fa3bfbd89be088ac7b94c3
MD5 (drupal-6.21-to-6.38.patch) = ddc1fdb03627c6696f37906eefb24015
MD5 (drupal-6.22-to-6.38.patch) = 1f030d8d09fe46c1c2db1015c07e0ccf
MD5 (drupal-6.23-to-6.38.patch) = efb5da9154eb837741a0570cda17d12a
MD5 (drupal-6.24-to-6.38.patch) = b34e67825b96e33be0c5332282693a6f
MD5 (drupal-6.25-to-6.38.patch) = 2409998fc5e01ef6360d3733c445a1c2
MD5 (drupal-6.26-to-6.38.patch) = 7dffd85efe4aa90adb7456a17ce67e61
MD5 (drupal-6.27-to-6.38.patch) = 49fb0914992a0b6b65e5fd6cc524401e
MD5 (drupal-6.28-to-6.38.patch) = 4268112f0026f4afa09c46897afcb6f1
MD5 (drupal-6.29-to-6.38.patch) = 41ca230f7adce19d7c39d9ea6d3e542d
MD5 (drupal-6.30-to-6.38.patch) = ca9fe9d15f9e3478d699bc0c3314db54
MD5 (drupal-6.31-to-6.38.patch) = 59208e43f9bc8f717882d9fec6521914
MD5 (drupal-6.32-to-6.38.patch) = 95a6b9d4e6be5b04a941e5ebdddd8357
MD5 (drupal-6.33-to-6.38.patch) = 3ed549798aac6fe41e82b1567feeb6c8
MD5 (drupal-6.34-to-6.38.patch) = a03faa3ab186df76914727cacfb670c1
MD5 (drupal-6.35-to-6.38.patch) = b5d342cf0a2cb7948c2dbed9705e10e1
MD5 (drupal-6.36-to-6.38.patch) = 06e5a118fc8807cf2be285836a553173
MD5 (drupal-6.37-to-6.38.patch) = 2ee9c1bacd7117fadf172ef6df45fd41

SA-CORE-2018-002 / SA-CORE-2018-004 for Drupal 6

Use this files to patch Drupal 6.38, one after the other. These are the Backport commits from the Drupal 6 Long-Term Support project:

  1. drupal6_SA-CORE-2018-002.patch, see Backport of fixes from SA-CORE-2018-002
  2. drupal6_SA-CORE-2018-004.patch, see Backport of fixes from SA-CORE-2018-004

To verify the integrity of the patch file use this MD5 hash:

MD5 (drupal6_SA-CORE-2018-002.patch) = 938bae84ec554b6d2fe4bb56912111b0
MD5 (drupal6_SA-CORE-2018-004.patch) = 7dc9f039bf415fc6e4e7fcbce1ab1ca3

Drupal 5

To verify the integrity of the patch files use this MD5 hashes:

  MD5 (drupal-5.0-to-5.23.patch) = 13235f0c50caf2f0366403563053fbba
  MD5 (drupal-5.1-to-5.23.patch) = e2d5fc4ec6da1f1db2f83204eef03160
  MD5 (drupal-5.2-to-5.23.patch) = 13da34e36fb58f422c86c1574e26719b
  MD5 (drupal-5.3-to-5.23.patch) = dd826e692ab5e9e50ce55feac0b82673
  MD5 (drupal-5.4-to-5.23.patch) = e44a1f00549c5d39bbe359772db4ec9d
  MD5 (drupal-5.5-to-5.23.patch) = 4f06344f52f3c476e458f01c4925e987
  MD5 (drupal-5.6-to-5.23.patch) = bd31200144a9b716e4a1cad1930796f1
  MD5 (drupal-5.7-to-5.23.patch) = 598e037a8840d79509ea5c247dff975e
  MD5 (drupal-5.8-to-5.23.patch) = 2a53dedeb3b00c679ccb0dae44379789
  MD5 (drupal-5.9-to-5.23.patch) = 8dd63096cf7c5dd73e968f770f56301b
  MD5 (drupal-5.10-to-5.23.patch) = a6127a53d945659efde17a31e8037b79
  MD5 (drupal-5.11-to-5.23.patch) = 841eabce62cac99f98e77de733aeb7c6
  MD5 (drupal-5.12-to-5.23.patch) = ddb82f96ad7915e34111df4706237c11
  MD5 (drupal-5.13-to-5.23.patch) = 41bf265e25a1d6c9324e4f6c7b5ff067
  MD5 (drupal-5.14-to-5.23.patch) = 7c48dca7dd10533fe65c895d33c7be56
  MD5 (drupal-5.15-to-5.23.patch) = ae1a31e80c3b24dfa1710adecbd1cce9
  MD5 (drupal-5.16-to-5.23.patch) = 72e25e1c680b75cbc1f8b303c4d97cba
  MD5 (drupal-5.17-to-5.23.patch) = 0fee19e0808ec863284618ce8f506d6c
  MD5 (drupal-5.18-to-5.23.patch) = 997f35d8372277203e5129e9bc684f81
  MD5 (drupal-5.19-to-5.23.patch) = 6189d7c3c3139647dfd519b727d8f12f
  MD5 (drupal-5.20-to-5.23.patch) = 33d48157e036411fd336a5d9023c8644
  MD5 (drupal-5.21-to-5.23.patch) = 86cb8be7e01f576177765d670332e4fb
  MD5 (drupal-5.22-to-5.23.patch) = 94488c667c2c68d48438d81129e3edca

SA-CORE-2018-002 / SA-CORE-2018-004 for Drupal 5

  1. SA-CORE-2018-002 for Drupal 5
  2. SA-CORE-2018-004 for Drupal 5


Thanks - must have missed

Thanks - must have missed that release.

No worries. No doubt it's

No worries. No doubt it's just a bugfix release but it's nice to have that nag screen every time I login.

OT: any idea why this error message popped out? "Deprecated function: Call-time pass-by-reference has been deprecated in drupal_load() (line 911 of /var/www/drupal7/includes/bootstrap.inc)."

It shows up pre-7.8 update. I am upgrading the site to 7.8 now to see if it'll get rid of it.

apparently the error message

apparently the error message still exists.

"Deprecated function: Call-time pass-by-reference has been deprecated in drupal_load() (line 1100 of /var/www/drupal7/includes/bootstrap.inc)."

Ubuntu Server compatible?

Hey, I just stumbled across your site and am very intrigued.

I have a Drupal 7.2 site running on Ubuntu Server (10.04, with all the latest updates applied).

I'd like to use your patch to update from 7.2 directly to 7.8. Do the commands you provided work in an Ubuntu terminal? Are there any known issues or problems with applying the 7.2>7.8 patch on an Ubuntu 10.04 server?


I used it at Ubuntu, Debian

I used it at Ubuntu, Debian and Mac OS X without problems so far. Your setup may be different so you better test the process using a copy of your current Drupal installation.


In this kind of posts everyone assumes you know how to apply a patch. In combination with the very poor documentation on internet it's really hard to figure out how to do it in a proper way :(.

As with every trade - you

As with every trade - you need to learn it. To apply a patch correctly you need to know how to use a UNIX/Linux command line. If that's not the case you always can simply follow the UPGRADE.txt guide located at the Drupal directory root instead of using patches.


Brilliantly easy to upgrade Drupal like this!

Thank you.


It's awesome! Great! From 6.22 to 6.25 - without any error!

Thank You.

I am sooooo happy to find this page. I'm relatively new to using Drupal and it's not my main job, just a volunteer thing. Yay. Yay.

Thx again

Thanks again. Updating couldn't be easier.


What a pleasure

Couldn't have been easier - a thousand thank yous - keep up the great work.


I would just like to add my thanks for the work you're doing. I know it takes time to build all these patches, especially since you need to keep "vanilla" copies of all those Drupal releases around. But you are saving a lot of people hours of work with the upgrades.

Thanks again!

Thank You!

I know other people have repeatedly thanked you for this but this has been really helpful for me in keeping Drupal up to date on the sites I maintain. Thanks again!

7.17 to 7.18 errors

I'm getting a few errors when trying the 7.17 to 7.18 patch on two different sites:

patching file modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
Hunk #1 FAILED at 5.
1 out of 1 hunk FAILED -- saving rejects to file modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info.rej

patching file modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
Hunk #1 FAILED at 5.
1 out of 1 hunk FAILED -- saving rejects to file modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info.rej

patching file profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
Hunk #1 FAILED at 6.
1 out of 1 hunk FAILED -- saving rejects to file profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info.rej

patching file profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
Hunk #1 FAILED at 8.
1 out of 1 hunk FAILED -- saving rejects to file profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info.rej

Any suggestions? Is it safe to ignore these and patch anyway?

BTW, these patches are wonderful - please keep up the great work.

It's not save to ignore any

It's not save to ignore any error during the patch process. You better don't patch and follow the standard upgrade procedure instead.

very helpful and easy

thanks for this very easy tool. It works wonderful and is quick done!

Anyone managed to run 6>7 patch ?


I was just wondering if anyone managed to do any successful upgrade using the path for 6 to 7 migration?


Thanks a lot for this service.

I have now used it twice to do an upgrade on all sites I manage.

It was a cinch, both times.

The only suggestion I have is to perhaps put up the single security update from 7.n to 7.n+1 as soon as possible after Drupal notifies of the update. The others - (n to n+x) - could wait, since they have been waiting already. :) This is because I believe that Drupal sites become a natural target as soon as the need for a security update is out in the public. I was sitting on tenterhooks the last few days whilst waiting for the 7.19 to 7.20 patch. :)

Anyway, thanks again for the super service. I had been looking at Drupal alternatives because of the upgrade process. Your service gets around that. I don't understand why Drupal has not done this themselves.

Corrupted file

file drupal-7.15-to-7.23.patch is corrupted, would you check this

No problem detected

I tried it patching a fresh 7.15. No problems detected. Please check your download using the MD5 checksum and follow the guidelines at this page.

My download file is corrupted

My download file is corrupted since line 42861 to 44399

Could you check file on server and change it

I will be grateful.

That's a binary file you are

That's a binary file you are looking at line 42862. It looks scrambled by design. As mentioned above the patch works well. So nothing to be worried about.

7.24 missing 'drupal.org' from packaging script in *.info files

See here for more info https://drupal.org/node/2141481

At first, thanx for this page

At first, thanx for this page :)
How long time taking patch process? (7.23->7.24)

Usually some seconds only.

Usually some seconds only. Depends on your system.

Does it matter if default.settings.php fails patch?


Thank you for this amazing service you do.

I've been patching fairly regularly with Drupal 6 and it works perfectly. I rebuilt the site with Drupal 7 and I'd like to go from 7.14 to 7.26 and on the dry-run the only error I receive is:

patching file sites/default/default.settings.php
Hunk #1 FAILED at 5.
Hunk #2 FAILED at 137.
Hunk #3 FAILED at 261.
Hunk #4 FAILED at 297.
Hunk #5 FAILED at 425.
Hunk #6 FAILED at 480.
6 out of 6 hunks FAILED -- saving rejects to file sites/default/default.settings.php.rej

I thought that Drupal doesn't use the default file, but the modified settings.php that you create on installation. If that's the case, could I proceed with the patch and have it somehow ignore this?


You may reset

You may reset sites/default/default.settings.php to it's default by copying it from a fresh Drupal 7.14 folder. Older Drupal relases are listed here: https://drupal.org/node/3060/release

Thank you so much

It's so easy to update sites with the patches! Thank you to deliver these patches continuously for years.

Issue with patch 7.32 to 7.34

I've been using your patches almost since I started using Drupal. I really appreciate your doing this. I usually never have a problem, but using 7.32 - 7.34 I had a problem: /modules/field/modules/field_sql_storage/field_sql_storage.module didn't patch right. I didn't get any errors, but I did run patch -N twice because default.settings.php was unwritable, forgot to chmod the directory before patching. I don't know if somehow the file ended up in a bad state or what, but it had a duplicate function defined. I grabbed the file from drupal.org and replaced it and that fixed the problem. Just an FYI.



In case you urgently need to upgrade earlier than Bernhard can update his site, use the following script to create a similar patch:


It results in a content identical patch to the ones Bernhard creates (minus packaging data differences if you run it at a different time than Bernhard).


7.50 was released one week ago, will you publish a new patchfile?

7.52 to 7.53

Hi Bernhard, been using your patches for a while and really appreciate your work. I'm having issues with this latest patch though, it wipes out all the contents of my installation except the sites directory. And it tries to delete .gitignore, .editorconfig and .htaccess which I don't have

You are right - the patches

You are right - the patches where accidentally created without having 7.53 available. It's fixed now - sorry for the inconveniences!