security updates

Drupal's first-generation Automatic Updates setup is no longer something teams can leave on the backlog. With the old Drupal.org API retired and the legacy hash files expiring on May 12, 2026, Composer, Package Manager, and deployment-workflow cleanup has become part of basic update readiness.

WordPress 6.9.2 is a useful reminder that patching WordPress is not just an admin task. For business sites, the real work is having a repeatable runbook: backup first, update core in a controlled way, handle the database step, and verify file integrity before and after the change.