Automatic major-version upgrades are a convenient way to break production on a Friday. Here is what we do instead.
Every platform that manages databases for customers eventually faces the same question: when upstream releases a new major version, whose problem is the migration?
| Change | Behaviour |
|---|---|
| Patch release | Applied at next restart, announced in the changelog |
| Minor release | Offered in the console, one click, reversible |
| Major release | Never applied automatically. Requires an explicit service change |
Purely manual upgrades mean security patches sit unapplied. Purely automatic major upgrades mean a Tuesday morning surprise. Splitting behaviour by the kind of change keeps both problems small.