How do I update core with Composer?

Question

Ok, admittedly I'm a composer novice. So, in my previous site, I used composer manager to update Drupal's core. That was pretty straight forward to use (just run "composer drupal-update"). However, composer manager now says it's deprecated.

The Drupal 8 version of this module is deprecated and no longer needed, due to improvements in Drupal 8.1. Use Composer directly to get the needed modules, which will also download their required libraries.

So today I got a warning that I need to apply security updates to core, but I can't find any documentation on how you would update Drupal core with composer.

Is this done through Drupal Console, Drush or is it an actual composer command I need to run? I'm not very clear on what the preferred process is outside of "download the latest version of Drupal from drupal.org and replace all the files manually".

Answer 1

To update Drupal using Composer, you just need to move the "drupal/core": "~8.1" line from the replace section to the require section. At the end the content of the composer.json file is like the following one.

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/core": "~8.1"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    },
}

I was used to run drush upc to update Drupal, but that overriden my composer.json file, and the vendor directory. As consequence of this, I should run composer update all the times to update the content of the vendor directory.

Now, using Composer to update Drupal, I can also use it to download/update the modules I am using.

The composer.json file I am using is the following one.

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/core": "~8.1",
        "drupal/imagick": "8.1.*@dev",
        "drupal/mollom": "^8.1",
        "drupal/honeypot": "^8.1"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    },
    "repositories": {
        "drupal": {
            "type": "composer",
            "url": "https://packagist.drupal-composer.org"
        }
    }
}

Apart from moving that line as I said, I also executed the following commands.

composer config repositories.drupal composer https://packagist.drupal-composer.org
composer require drupal/honeypot
composer require drupal/mollom
composer require drupal/imagick 8.1.*@dev

The first allows me to require Drupal modules and update them.

The last time I tried, the Drupal official repository was still in alpha stage, and it gave me problems with modules that declared themselves as Composer packages, but not setting the package type (i.e. drupal-module). I hope they fixed the problem, now. For the Drupal Packager repository, the commands to use are the following.

composer config repositories.drupal composer https://packages.drupal.org/8
composer require drupal/honeypot
composer require drupal/mollom
composer require drupal/imagick 1.*@dev

If you were already using https://packagist.drupal-composer.org, and you want to replace with the official Packagist site, you need to replace the first command with composer config repositories.0 composer https://packages.drupal.org/8, which works if you don't have other repositories, basing on Using packages.drupal.org.

Notice also that packagist.drupal-composer.org is scheduled to be deprecated in January 2017 (or when the official Package Repository from Drupal.org is ready).