I’m thinking of auto-updating Discourse via cronjob. For example every two weeks in the night a cronjob with the following:
cd /var/discourse
./launcher rebuild app
Do you think this is safe to do? Or should I do this manually?
AI-generated summary
The discussion centers on the safety of automating Discourse updates via cronjobs. OrkoGrayskull initially proposed a bi-weekly nightly update script, seeking advice on potential risks. pfaffman warned that failures could break the site, suggesting manual oversight, while OrkoGrayskull countered that sending build logs via email would allow for morning checks. Alexander shared a successful strategy using a two-container installation to ensure the new version boots before replacing the old one.
Security concerns were raised by Alon1, who advocated for daily updates to mitigate risks like recent npm library hacks, despite the lack of a mechanism to separate security patches from general updates. Ed_S advised against daily automation, noting that increased frequency leads to more downtime and potential outages requiring developer intervention. Canapin emphasized that while updates are rarely problematic, they can introduce silent bugs or plugin incompatibilities, recommending a delay to monitor the bug category before applying changes.
Ultimately, Canapin argued that while manual updates are safer, automated updates are not inherently risky; users can always revert if issues arise. The consensus leans towards a balanced approach: either manual updates after monitoring release notes or automated updates with robust fallback mechanisms and monitoring.
It’s possible that something will go wrong and you’ll leave your site broken. I recommend that you list attention when you do it.
Yeah. I was thinking of sending all the build output via mail, so I can check in the morning.
Personally, I do the exact same thing with my sites, but I use the two-container install in case the bootstrap fails.
Only if the bootstrap completes successfully does the old container stop and the new one start.
So far I have had no problems
As Jay said, in rare cases, an update can sheep issues (whether in Discourse itself or with plugins/components).
I’ve seen it happen a couple of times in a few years. It’s very rare, and fixes are made quickly, but because of this, I tend to get information on the updates (and check the Contribute > Bug category 
) before rebuilding my instances. I often wait for a few days after a new version is officially released.
And do a ./launcher cleanup sometimes as well.
So, I prefer to update when I want and after gathering information. I have potential damage control, it’s safer.
Anything new about this in 2026?
I’d like to implement security updates asap (even at the risk of breaking a production site because of unattended update). Discourse doesn’t actually distinguish between security updates and other.. so I don’t mind just updating everything, every day. Is corn job still the way to go?
I personally wouldn’t do it. On the one hand, I don’t even need to update monthly for security fixes - which is to say, I read the release notes and make a decision. On the other hand, if you update daily, you’ll find more of the rare times when the thing will fail. You’ll have more downtime, for sure.
If you don’t mind that the cron job will sometimes kill the forum, until someone skilled comes to fix it, then sure, run the cron job. But bear in mind the skilled person might need to engage the developers here and wait some more hours until the thing is diagnosed and fixed.
A discourse update has not broken my forum in the last 4 years so I’m not concerned. If it does break once in a blue moon, i can take it.
My concern is more around security, and recent events (such as Axios npm packages a week ago…) with library hacks suggest that we may want to update libs +7 days after a new release.
If it were possible to update security related things immediately and the rest on a 7 day delay that would probably be ideal, but I don’t think it’s supported on Discourse.
An update issue might not only crash the forum, it can instead silently introduce new bugs, broken features, plugin or component incompatibilities, etc — though it’s rare.
Even if drastically increasing the update frequency on your forum increases the risks of facing crashes or bugs, you can always see how it goes and revert if you face too many inconveniences.
What I’m saying is, while it might not be the best idea according to some, it’s also not really risky either.