def METHOD_NAME(request, pk=None):
    update = ProjectUpdate.objects.get(pk=pk)
    # TODO: permissions
    data = request.data
    if 'photo' in data:
        update.photo = data['photo']
        update.save(update_fields=['photo'])
    return Response(ProjectUpdateExtraSerializer(update).data)