Using Drush lock files with contributed modules

Drush 8 and earlier versions include the up parameter to allow you to quickly update your website's modules. Although this parameter can be convenient, updating a live website before adequate testing could cause problems or outages. It can also result in modified modules being overwritten, eliminating their modification. To protect against this, you can add Drush lock files to your modules.

Using Drush aliases

If you're already familiar with Drush aliases, you can issue Drush commands from a local installation and have them take place on a remote server.

To do this, use a Drush alias that's similar to the following from a command prompt (replacing with the module's name, and with a descriptive message):

This command will only work for drush 8 and earlier. For Drush 9 please follow the manual process in this document. Note, Drush 9 requires installation via Composer & assumes you are working with a Composer built site.

drush @mysite.dev pm-updatestatus --lock=moduleName --lock-message="" 

This command has the same effect as creating a manual lock directly on the server.

Creating locks on the server

If you're comfortable with working on the server itself (or working directly on the server is a requirement), you can either use Drush or create the lock manually:

Using Drush 8 (If you have installed Drush 9, refer to "Locking a module's version with Composer
" below.)

You can use Drush to prevent other users from updating modules through Drush. You can also remove the locks from the modules if you need to remove the protection.

Locking modules using Drush 8

To lock a module and prevent other users from updating it with Drush, complete the following steps:

1. Enable livedev mode on your website.
2. Sign in to your server using SSH.
3. Change to your website's docroot.
4. Run a command similar to the following to lock the module (replacing with the module's name, and with a descriptive message):

   drush pm-updatestatus --lock=ModuleName --lock-message="" 

5. Commit the changes.
6. Disable livedev mode.

Removing a module lock with Drush 8

To unlock modules if locking is no longer needed:

1. Enable livedev mode on your website.
2. Sign in to your server using SSH.
3. Change to your website's docroot.
4. Run a command similar to the following to lock the module (replacing with the module's name):

   drush pm-updatestatus --unlock=ModuleName

5. Commit the changes.
6. Disable livedev mode.

Manually creating locks

If you don't want to use Drush, you can also manually create (or remove) module locks in your code repository.

Creating a lock

To create a module lock in the repository, complete the following steps:

1. In your code repository, navigate to the folder that contains the module to which you want to add a lock.
2. Create a file called .drush-lock-update that contains text describing the need for the module lock, just as you would use for the lock message in --lock-message="" . The file supports line breaks.
3. Commit the file to your repository.

Repeat the process for each module that requires a lock.

Deleting a lock

To remove a lock from a module, complete the following steps:

1. In your code repository, navigate to the folder that contains the module that you want to unlock.
2. Delete the .drush-lock-update file.
3. Commit your changes to the repository.

Drush 9 requires installation via Composer

Composer pinning replaces drush locking.

Locking a module's version with Composer

You can specify the exact version of a package. This will tell Composer to install a specific version of a module or dependency and is called Pinning. If other dependencies require a different version of a module or dependency that you have pinned, the solver will ultimately fail and abort any install or update procedures.

Example: 1.0.2

Testing Version Constraints#

You can test version constraints using semver.mwl.be. Fill in a package name and it will autofill the default version constraint which Composer would add to your composer.json file. You can adjust the version constraint and the tool will highlight all releases that match.