Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Right now you could set up the auto-update script to run as server cron job run as root. You should not run this as root
Steps to reproduce
Proposed resolution
We should stop auto-update script from running as script but right now we should just warn otherwise we could stop a site from receiving an update if they were relying on current server cron job
Create a RootUserValidator(or something) that warns if being run as root.
Remaining tasks
In a follow-up in 3.1.x we should stop auto-update script
User interface changes
API changes
Data model changes
Issue fork automatic_updates-3432476
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
tedbowComment #4
phenaproximaComment #6
tedbowComment #7
tedbow@phenaproxima pointed out we didn't make this a service 🤦🏼
Comment #10
tedbowThis doesn't need to go into 3.1.x because we not allow running as root then