Issue with auto update option #45

New Issue

2024-09-04T06:05:08Z

dwaxweiler commented

2024-09-04 06:05:08 +00:00

I successfully deployed a WordPress site without changing the default option ENABLE_AUTO_UPDATE=true but WordPress' site health tool displays the errors that the WP_AUTO_UPDATE_CORE constant is defined as false and that WordPress security and maintenance releases are blocked by define( 'WP_AUTO_UPDATE_CORE', false );.

I successfully deployed a WordPress site without changing the default option `ENABLE_AUTO_UPDATE=true` but WordPress' site health tool displays the errors that the `WP_AUTO_UPDATE_CORE` constant is defined as `false` and that WordPress security and maintenance releases are blocked by `define( 'WP_AUTO_UPDATE_CORE', false );`.

decentral1se commented

2024-09-04 11:13:18 +00:00

@dwaxweiler hey 👋 (and welcome? 🎉) I believe the ENABLE_AUTO_UPDATE=true is not related to define( 'WP_AUTO_UPDATE_CORE', false );. The ENABLE_AUTO_UPDATE deals with kadabra, our prototype auto-upgrade tool: https://docs.coopcloud.tech/operators/tutorial/#automatic-upgrades

So, I maybe you need to look at another env var (maybe one of the recipe maintainers will know?) or you need to adjust the recipe to be able to configure this value.

@dwaxweiler hey 👋 (and welcome? 🎉) I believe the `ENABLE_AUTO_UPDATE=true` is not related to `define( 'WP_AUTO_UPDATE_CORE', false );`. The `ENABLE_AUTO_UPDATE` deals with `kadabra`, our prototype auto-upgrade tool: https://docs.coopcloud.tech/operators/tutorial/#automatic-upgrades So, I maybe you need to look at another env var (maybe one of the recipe maintainers will know?) or you need to adjust the recipe to be able to configure this value.

👍 1

dwaxweiler commented

2025-12-15 06:38:09 +00:00

Ah, thanks for your clarification! Then, this recipe sets WP_AUTO_UPDATE_CORE to false. Could you set it to minor or expose it via the config file please? In the past, WordPress fixed important vulnerabilities using this automatic update process.

Ah, thanks for your clarification! Then, this recipe sets `WP_AUTO_UPDATE_CORE` to `false`. Could you set it to `minor` or expose it via the config file please? In the past, WordPress fixed important vulnerabilities using this automatic update process.

3wordchant commented

2026-01-30 05:10:31 +00:00

@dwaxweiler thanks for the report (and likewise, welcome!).

I have mixed feelings about apps self-updating; I assume the reason that @moritz set WP_AUTO_UPDATE_CORE=false (back in 55f00a4) was that it's confusing if the version reported by abra is different to the actual version running – and the version will be (probably-unexpectedly) reset after an undeploy / deploy – and I would agree with that rationale.

I think project-wide the expectation is that folks will be staying on top of recipe updates by e.g. configuring renovate, or running abra app ls -S periodically. Otherwise, folks might be getting Wordpress security updates but missing out on security updates for other apps they're running (including, at minimum, Traefik or Caddy).

All of that said, I would support making this configurable, as long as the default remains false. I can make this change myself eventually, but very happy for you to make a pull request if you're able.

@dwaxweiler thanks for the report (and likewise, welcome!). I have mixed feelings about apps self-updating; I assume the reason that @moritz set `WP_AUTO_UPDATE_CORE=false` (back in 55f00a4) was that it's confusing if the version reported by `abra` is different to the actual version running – and the version will be (probably-unexpectedly) reset after an `undeploy` / `deploy` – and I would agree with that rationale. I think project-wide the expectation is that folks will be staying on top of recipe updates by e.g. configuring [`renovate`](https://git.coopcloud.tech/coop-cloud/renovate/), or running `abra app ls -S` periodically. Otherwise, folks might be getting Wordpress security updates but missing out on security updates for other apps they're running (including, at minimum, Traefik or Caddy). All of that said, I would support making this configurable, as long as the default remains `false`. I can make this change myself eventually, but very happy for you to make a pull request if you're able.

👍 1

kawaiipunk commented

2026-06-02 17:43:48 +00:00

@dwaxweiler are you still interested in this? If so, does the self managed version meet your needs?

@dwaxweiler are you still interested in this? If so, does the [self managed version ](https://git.coopcloud.tech/coop-cloud/wordpress/src/branch/main/compose.selfmanaged.yml)meet your needs?

👀 1

kawaiipunk commented

2026-06-03 21:24:25 +00:00

I have an early MVP that is relevant: bb63db7d2d

I'm not really sure it will work thought because of how wp works in the container. I might need to modify it a bit.

However it doesn't include core updates which I believe should be done using abra in the managed version.

I have an early MVP that is relevant: https://git.coopcloud.tech/kawaiipunk/wordpress/commit/bb63db7d2d13b66e618f35a79b24b449196415e1 I'm not really sure it will work thought because of how `wp` works in the container. I might need to modify it a bit. However it doesn't include core updates which I believe should be done using abra in the managed version.

dwaxweiler commented

2026-06-05 08:54:59 +00:00

@3wordchant I can totally follow the abra rationale!

@kawaiipunk thanks for adding this self-managed version! After reading the rationale behind, I would only set WP_AUTO_UPDATE_CORE to minor to let WordPress do small updates. Your MVP looks also good because outdated plugins even pose the bigger risk to a WordPress site.

@3wordchant I can totally follow the abra rationale! @kawaiipunk thanks for adding this self-managed version! After reading the rationale behind, I would only set `WP_AUTO_UPDATE_CORE` to `minor` to let WordPress do small updates. Your MVP looks also good because outdated plugins even pose the bigger risk to a WordPress site.

❤️ 1

Sign in to join this conversation.

4 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/wordpress#45