I am on D 8.3.0-rc2 and want to update to D 8.3.0 stable. Composer is my only option (requirement of address module). Composer core update doesn't bring me beyond 8.3-0-rc2, not even forcing it. Running drush composer require "drupal/core:^8.3@stable" gives me the following output:

./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update

The content of composer.json is the following.


"name": "drupal/drupal",
"description": "Drupal is an open source content management platform powering millions of websites and applications.",
"type": "project",
"license": "GPL-2.0+",
"require": {
    "composer/installers": "^1.0.21",
    "drupal/core": "^8.3@stable",
    "wikimedia/composer-merge-plugin": "~1.3",
    "drupal/address": "~1.0",
    "drush/drush": "^8.1"
"replace": {
"minimum-stability": "dev",
"prefer-stable": true,
"config": {
    "preferred-install": "dist",
    "autoloader-suffix": "Drupal8"
"extra": {
    "_readme": [
        "By default Drupal loads the autoloader from ./vendor/autoload.php.",
        "To change the autoloader you can edit ./autoload.php."
    "merge-plugin": {
        "include": [
        "recurse": false,
        "replace": false,
        "merge-extra": false
"autoload": {
    "psr-4": {
        "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
"scripts": {
    "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
    "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
    "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
    "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
"repositories": {
    "drupal": {
        "type": "composer",
        "url": "https://packages.drupal.org/8"

I read about deleting vendor and composer.lock, but I don't understand why this would work.

  • 1
    ive never seen "drush composer". what is it supposed to do?
    – user21641
    Commented Apr 19, 2017 at 9:55
  • It's the Drush command implemented by a module. It just calls Composer.
    – apaderno
    Commented Apr 19, 2017 at 11:48
  • @kiamlaluno - So it's the drush command of a module that's used to update the core here? Suspicious...
    – leymannx
    Commented Apr 20, 2017 at 16:24
  • 1
    @leymannx It's the Composer module.
    – apaderno
    Commented Apr 20, 2017 at 18:09
  • 1
    As I found out, composer... works as well (without the drush prefix) Commented Jun 2, 2017 at 16:54

2 Answers 2


Instead of trying to update Drupal directly with Composer, instead try starting with drupal-composer/drupal-project as a starting point. This project definitely works with Drupal 8.3.0.

Set up a new project with drupal-composer/drupal-project, and use composer require to add any modules you need. Once your code is the same in the new project as the old, you should be able to just copy the database over (or just point to your existing database with settings.php) and run updatedb.

  • 2
    If you go this route, you may need to adjust the "installer-paths" to match where your contrib stuff is now.
    – mpdonadio
    Commented Apr 19, 2017 at 20:18
  • Many thanks, @greg_1_anderson - this approach solved my problem (after a loooong composer learning curve and some other project obligations). drupal-composer/drupal-project exceeded the memory quota of my hosting plan, but drupal/drupal worked :-) Thanks again! Commented Jun 2, 2017 at 16:59
  • There is a follow-up question: All contextual menus (symbol in upper right of block) still contain the path of the build directory - not even updated by clearing all caches. Using the links (e.g. edit, edit view, etc.) causes fatal errors. Any idea where this information is stored and can be set to the current path? Commented Jun 5, 2017 at 12:31
  • My solution approach (there are very likely simpler ways...): 1) run create-project; 2) copy the code BEFORE calling it to set up Drupal; 3) export the "hot" database; 4) call Drupal in the target location to set it up (resets the DB!); 5) re-import the database Commented Jun 5, 2017 at 17:19

You already have the right version in your composer.json. Then it's just composer install (in your case it's drush composer install).

If that not works, delete your lock file and/or the vendor folder prior to calling composer install (or drush composer install).

And I guess composer update drupal/core (in your case drush composer update drupal/core) might work as well (since the version in your lock file or in the vendor folder is different from that in your composer.jon).

  • Thanks @leymannx, it was also my assumption that update or install should work, but for reasons which I don't understand none of it worked as expected (that's why I posted the request). My guess is that there were quire some internal changes with the update to Drupal 8.3.0 stable there were some "dependency deadlocks". The good news is that composer... works as well (instead of drush composer ...) Commented Jun 2, 2017 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.