Update all the things

The Upsun Rule: Update Early, Update Often

Upsun periodically updates its container images to incorporate the latest security updates from upstream providers (PHP, Ruby, MariaDB, etc.). While updates are not always applied immediately, they are generally implemented soon after a security vulnerability is identified and a corresponding fix is released.

However, these updates aren’t automatically propagated to individual projects as that would involve potential customer downtime. Instead, the latest available version of every requested container is loaded on each deploy to a given environment. After a deploy you are always guaranteed to be running the latest Upsun-provided version of a container.

If you are using Upsun-provided Let’s Encrypt TLS certificates, your site is automatically redeployed approximately once every two months to ensure it always has an up to date certificate. That also ensures your container versions are up to date at the same time.