The process is essentially the same as normal updates:
fetching new release tarball
extracting and replace old release
run the upgrade script
We have an internal hotfix tool for development which performs those steps, if run from within a git tree with the target release tag checked out. Mostly this is not provided automatically to those Cloudrons is, that we haven't tested the release jump much, so we don't want to risk users being offline until we have time to potentially fix some edge case on that server.