I knew that Drush make files were being phased out, but I kept using them, because in my opinion Composer isn't the best package manager in the known universe. It updates too much or too little, has uninformative error messages, and takes a lot more ram than necessary. Don't get me wrong, I still used composer, but not for Drupal core updates, because those are more important and sometimes security releases.

But, in 8.4, Drush 9 is required, and in Drush 9 make files don't work at all.

My concern is this: I have some wildcards in my composer.json similar to the ones mentioned in this issue: https://www.drupal.org/node/2609568 which tell composer where to find my modules' composer.json files. Yet, when I run

composer update drupal/core --with-dependencies

Whether or not I run it --with-dependencies, it will always go into the merge-plugin include paths and update all of those packages as well. Now, if my site is out in production, I would like an easy way to update core and core's vendor files WITHOUT updating a bunch of contrib modules' libraries which I do not care about. What if core releases a security update? I want to be able to conveniently update core and only core quickly. With Drush make, this was simple.

Has anyone figured out a way to do this with composer?

1 Answer 1


I do two things.

  1. I use webflo/drupal-core-strict in my composer.json to make sure the same tested core dependencies are the ones used in my project.
  2. I pin both drupal/core and webflo/drupal-core-strict to an exact Drupal version so I can regression test and know exactly what I am deploying.

So, my projects looks like

"require": {
    "drupal/core": "8.3.6",
    "webflo/drupal-core-strict": "8.3.6",
    "composer/installers": "^1.2",
    "drupal-composer/drupal-scaffold": "^2.2",
    "cweagans/composer-patches": "~1.0",
    "drush/drush": "~8.0",
    "drupal/console": "~1.0",

And where there is a new core version, I composer update drupal/core webflo/drupal-core-strict and then double check the lockfile.

  • 1
    I've also been using drupal-core-strict but I've always been struggling with weird conflicts with it, see github.com/composer/composer/issues/6131
    – Berdir
    Aug 14, 2017 at 21:26
  • So if I use this webflo/drupal-core-strict package, will it be available at the same time as a drupal update? Say 8.3.7 were to be released right this instant, when would webflo/drupal-core-strict 8.3.7 be released? Aug 14, 2017 at 22:28
  • 1
    @RaisinBranCrunch Immediately, no. It is maintained by someone heavily involved with core development, but not an official Drupal package. However, it has always been available very quickly. I think the last time there was an announcement to "get ready to update sites" b/c security, it was ready in ~15min.
    – mpdonadio
    Aug 14, 2017 at 23:01
  • Does this also work for updates to drupal 8.5.0?
    – LarS
    Mar 15, 2018 at 2:24
  • @LarS Yes, this will work for updates between minor versions.
    – mpdonadio
    Mar 15, 2018 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.