I'm very new to composer, I've only used it to install the occasional necessary library for our D8 projects. At each Drupal update I normally run

drush up drupal

Which (among other things) replaces the vendor folder and composer.json, so on sites with library dependencies, I need to re-run

composer require [library]

Aware of the touted benefits of Composer as a dependency manager, I want to use composer to maintain our Drupal projects. However I've run into issues, namely that

composer update

or composer update drupal/core --with-dependencies both give me "Nothing to install or update". After some reading, I found this resource https://github.com/drupal-composer/drupal-project. With this unzip, if I run

composer install

I get the correct latest version of Drupal installed in ./web. But when I use the yaml from the template composer.json file in my own composer.json file I still get "Nothing to install or update".

My folder structure is identical to the .zip distribution, so /core and /vendor and /sites etc are all in the same folder, so I have obviously adjusted the composer.json file according. But it doesn't matter what I do, I just get "Nothing to install or update" "Nothing to install or update" "Nothing to install or update"

So, I'm beginning to think that composer update with or without dependencies REQUIRES YOU TO HAVE INSTALL THE DRUPAL 8 PROJECT WITH COMPOSER TO BEGIN WITH.

Is that right? If so, then I can move on. If not then I need to know what I'm doing wrong. Right now it's not a big deal and I can manage the update process, but it seems each new project requires more and more non-core libraries, so I know composer will save me a lot of time in the future.

TL;DR - Can someone give me a kickstart to configuring my EXISTING, WORKING PRODUCTION SITES so I can use composer to update them, the usual ReadMe's don't seem to work properly with sites that weren't also installed with composer.


1 Answer 1


I got this working, I was very close but removing /vendor and composer.lock was what helped in the end. Here are the steps from the top:

  1. add the line "drupal/core": "~8.1" to the 'require' statement (or update it to whatever version you require - in my case ^8.0 - latest Drupal 8 release).
  2. Remove the drupal/core line from the 'replace' statement.
  3. Add the following line somewhere (at the end? I believe this should replace the existing repositories statement, more information here. ):

    "repositories": { 
        "drupal": {
            "type": "composer",
            "url": "https://packages.drupal.org/8" 
  4. Remove the /vendor folder

  5. Remove the composer.lock file
  6. Run your core update as follows

    composer update drupal/core --with-dependencies
  • You can add a repository via the command-line by running composer config repositories.drupal composer https://packages.drupal.org/8. Also if you are managing everything with composer you can start doing composer require drupal/<modulename> instead of manually modifying composer.json. Also, running composer update will update your composer.lock file so you don't need to delete it. If you're using Drupal 8.0.x, then you can't really manage things with composer without composer manager.
    – mradcliffe
    Commented Feb 1, 2017 at 13:30
  • @mradcliffe I recently converted a D8 site from drush management to composer management. Nuking compsoser.lock did seem to be a necessary step (still don't know why) to get this to work.
    – mpdonadio
    Commented Feb 1, 2017 at 14:25
  • Two notes. Personally, I like to pin core to a precise version so I am never surprised (eg,"drupal/core": "8.2.5",) to prevent update hook surprises. Also, adding the extra section from the page you reference ensures modules/themes/etc end up where you want them.
    – mpdonadio
    Commented Feb 1, 2017 at 14:28
  • The drupal-merge-plugin might help with not having to delete vendor or the lock file. I use that to bridge the gap between drush make and composer since I have some problems with using composer directly.
    – mradcliffe
    Commented Feb 1, 2017 at 14:30
  • Once I get the hang of what the correct yaml is, I'll look into the correct composer commands. Thanks mradcliffe
    – RominRonin
    Commented Feb 2, 2017 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.