Updating TubePress

TubePress updates the way WordPress does: one click in the admin panel fetches a signed release, verifies it, backs up, swaps the core and runs any database migrations. Your themes, plugins, media and settings are left untouched.

This page explains exactly what an update changes, how to apply one, and how to stay safe.

How updates work

Releases are distributed as signed packages from tubepress.io. Before TubePress touches a single file, every package is verified twice:

• a SHA-256 checksum — a mismatch aborts the update; and
• an Ed25519 signature — the core refuses to install without a valid signature, so a tampered or unsigned core package is rejected outright.

An update only ever replaces the fixed core. Concretely:

Right before swapping files, TubePress copies the current core to storage/backups/ and takes a database backup. If it cannot create that database backup, the core update aborts rather than risk your data. Files are then swapped atomically, new numbered migrations in sql/ run automatically, and the outcome is written to an update log you can review or roll back from.

One-click update

Go to Admin → Updates at /admin/updates (administrator access required). The screen shows your current version and any available updates for the core, plugins and themes. Check for updates re-queries tubepress.io on demand.

Click to apply an item and TubePress downloads, verifies, backs up, swaps and migrates — then records the result. If anything looks wrong afterwards, you can roll back to the backup it just made.

Automatic updates

Prefer hands-off? Enable the auto_update_enabled setting (it is off by default). When on, a background pseudo-cron task checks periodically and applies pending updates at most once a day. For safety it is deliberately conservative:

• the core and free plugins update automatically;
• themes are always left for you to update manually, so your customisations are never overwritten unattended; and
• paid items are skipped — they need a purchase from the marketplace.

The scheduler is the same built-in pseudo-cron used elsewhere — see Maintenance.

Manual update

The one-click updater is the recommended path because it is the only one that also verifies signatures, makes backups and runs your database migrations. If your panel genuinely cannot reach tubepress.io (a firewalled or air-gapped host), you can update by hand:

1. Back up first. Take a full file and database backup — see Backups.
2. Get the official release. Download the signed ZIP from the download page or your account.
3. Replace only the core. Overwrite src/, sql/, templates/admin/, templates/install/ and config/app.php from the new release. Leave themes/, plugins/, public/uploads/ and config/database.php in place.
4. Apply new migrations. Apply any new numbered files in sql/ to your database — this is the step the built-in updater normally does for you.

The PHP version guard

TubePress ships a tiny, parse-safe gate (config/php-guard.php) that runs at every entry point before the application boots. It is written in deliberately old-style PHP so it parses on any version — which means if a site is moved to, or downgraded onto, a PHP older than the required 8.2, visitors see a clean “PHP upgrade required” page instead of a raw fatal error.

This matters around updates: newer releases may use newer PHP syntax, so confirm your host runs PHP 8.2 or newer (8.4 recommended) before and after updating. More detail in Maintenance.

Before you update

Updates are designed to be safe and reversible, but a backup is still your seatbelt:

• Back up files and database — the updater makes its own, but keep your own copy too. See Backups.
• Check PHP — confirm you are on 8.2+ (ideally 8.4).
• Note your customisations — theme and plugin changes are preserved, but a quick inventory never hurts.
• Update at a quiet time — the swap is near-instant, but pick low traffic just in case.

Next steps