How to safely update contrib modules

Install Read Only Mode module (https://www.drupal.org/project/readonlymode). In this way, people still have access to the content, but there is no risk that the content is changed while you make the changes.

1. turn on Read Only Mode with Drush: drush vset site_readonly 1
2. clone foo.com to upc.foo.com
3. Update modules on upc.foo.com with Drush: drush pm-update --no-core --no-backup

4. test that everything works on upc.foo.com
5. migrate foo.com to old-foo.com (migrating effectively renames the site)
6. migrate upc.foo.com to foo.com

7. turn off Read Only Mode with Drush: drush vset site_readonly 0

Further documentation at https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298