10

Ok, admittedly I'm a composer novice. So, in my previous site, I used composer manager to update Drupal's core. That was pretty straight forward to use (just run "composer drupal-update"). However, composer manager now says it's deprecated.

The Drupal 8 version of this module is deprecated and no longer needed, due to improvements in Drupal 8.1. Use Composer directly to get the needed modules, which will also download their required libraries.

So today I got a warning that I need to apply security updates to core, but I can't find any documentation on how you would update Drupal core with composer.

Is this done through Drupal Console, Drush or is it an actual composer command I need to run? I'm not very clear on what the preferred process is outside of "download the latest version of Drupal from drupal.org and replace all the files manually".

2
  • You can use drush drush up drupal, I think this might override your composer.json tho (and other files) so back it up and revert if needed. After that use composer update and you should be good to go
    – Trupal
    Jun 16 '16 at 23:36
  • "(and other files)", Yeah, it's the "other files" I'm worried about. At that point I might as well manually replace them from the official download and run composer update. It's seems like there should be an easier process. Deprecating composer manager doesn't seem to make a lot of sense when there is no alternative at the moment. Jun 17 '16 at 13:52
10

To update Drupal using Composer, you just need to move the "drupal/core": "~8.1" line from the replace section to the require section. At the end the content of the composer.json file is like the following one.

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/core": "~8.1"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    },
}

I was used to run drush upc to update Drupal, but that overriden my composer.json file, and the vendor directory. As consequence of this, I should run composer update all the times to update the content of the vendor directory.

Now, using Composer to update Drupal, I can also use it to download/update the modules I am using.

The composer.json file I am using is the following one.

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/core": "~8.1",
        "drupal/imagick": "8.1.*@dev",
        "drupal/mollom": "^8.1",
        "drupal/honeypot": "^8.1"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    },
    "repositories": {
        "drupal": {
            "type": "composer",
            "url": "https://packagist.drupal-composer.org"
        }
    }
}

Apart from moving that line as I said, I also executed the following commands.

composer config repositories.drupal composer https://packagist.drupal-composer.org
composer require drupal/honeypot
composer require drupal/mollom
composer require drupal/imagick 8.1.*@dev

The first allows me to require Drupal modules and update them.

The last time I tried, the Drupal official repository was still in alpha stage, and it gave me problems with modules that declared themselves as Composer packages, but not setting the package type (i.e. drupal-module). I hope they fixed the problem, now. For the Drupal Packager repository, the commands to use are the following.

composer config repositories.drupal composer https://packages.drupal.org/8
composer require drupal/honeypot
composer require drupal/mollom
composer require drupal/imagick 1.*@dev

If you were already using https://packagist.drupal-composer.org, and you want to replace with the official Packagist site, you need to replace the first command with composer config repositories.0 composer https://packages.drupal.org/8, which works if you don't have other repositories, basing on Using packages.drupal.org.

Notice also that packagist.drupal-composer.org is scheduled to be deprecated in January 2017 (or when the official Package Repository from Drupal.org is ready).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.