I am trying to determine the best way to maintain a Drupal 8 site. I am new to Drupal, PHP and Composer, but I am learning.

I believe that my goal is to maintain my Drupal 8 site using drupal-composer/drupal-project (https://www.drupal.org/node/2718229).

I am using a shared hosting plan, but I have shell SSH access. I notice that my hosting provider already has /opt/cpanel/composer/bin in my command line path. That version of composer is 7 months old. (Composer version 1.1.1 2016-05-17). I have PHP 5.6.29 via the command line.

It's possible for me to install the latest version of composer (1.3) in my user directory, and then to override the hosting service's path. I want to know whether it's worth the extra trouble to do so.

Purely from the standpoint of maintaining my Drupal sites (and not from the development point of view; I won't be making my own modules any time soon), how useful/critical would it be to have the latest stable version of Composer available to me? My guess is that the hosting service won't be updating Composer often (maybe once or twice a year).

Does a somewhat out-of-date version of Composer impose limitations on how effectively it can manage Drupal and Drush updates?

  • Yes, you could probably install composer in your user directory. No, it shouldn't matter using an out-of-date version of Composer.
    – mradcliffe
    Commented Jan 23, 2017 at 17:38

1 Answer 1


drupal-project has a composer version check built in that currently requires 1.0, so you're fine with 1.1 for now:


That said, more recent versions have performance improvements I think and sooner or later, there might be a problem that will force you to update, and then it will be easier if you already are using a custom more recent version. On the other side, your hosting provider might also update that version from time to time, you might want to check that with him. E.g. in case of a security issue.

But no, for now, you're not required to do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.