6

I'm just starting to work with Drupal 8 and composer and I'm trying to figure out how the updating workflow should work. I know the basics from administering a Drupal 7 server for years, but the Composer part is tripping me up.

Right now I run, from the root folder of my Drupal install, (with maintenance mode enabled) composer outdated and I get a list of a bunch of packages in need of an update.
As far as I can tell from the documentation, I should only be updating the packages that start with "drupal/". Assuming just the console and core come up as outdated, I run composer update drupal/console drupal/core --with-dependencies and that pulls down the updates, and does its thing. After this is done, if I run composer outdated again, I still see a bunch of packages that are outdated according to composer. Is that intended? Or should these packages be updated?

I'm guessing Drupal is built using specific versions of packages, so updating all of them would probably break some stuff, right? How is someone supposed to know what packages should be updated and which ones should stay at a specific version?

This is what I get when I run composer outdated.

alchemy/zippy                         0.4.3       0.4.8       Zippy, the archive manager companion
composer/installers                   v1.4.0      v1.5.0      A multi-framework Composer library installer
consolidation/annotated-command       2.8.1       2.8.2       Initialize Symfony Console commands from annotated command class methods.
consolidation/output-formatters       3.1.12      3.1.13      Format text by applying transformations provided by plug-in formatters.
cweagans/composer-patches             1.6.2       1.6.4       Provides a way to patch Composer packages.
dflydev/dot-access-data               v1.1.0      v2.0.0      Given a deep data structure, access data by dot notation.
drupal/php                            1.0.0-beta1 1.0.0-beta2 Allows embedded PHP code/snippets to be evaluated. Enabling this can cause security and performance issues as it allows users to execute PHP code on your site.
egulias/email-validator               1.2.14      2.1.3       A library for validating emails
fabpot/goutte                         v3.2.1      v3.2.2      A simple PHP Web Scraper
gabordemooij/redbean                  v4.3.4      v5.0        RedBeanPHP ORM
jcalderonzumba/gastonjs               v1.0.3      v1.2.0      PhantomJS API based server for webpage automation
phpdocumentor/reflection-docblock     2.0.5       4.2.0      
phpspec/prophecy                      v1.7.2      1.7.3       Highly opinionated mocking framework for PHP 5.3+
phpunit/php-code-coverage             2.2.4       5.3.0       Library that provides collection, processing, and rendering functionality for PHP code coverage information.
phpunit/php-file-iterator             1.4.2       1.4.5       FilterIterator implementation that filters files based on a list of suffixes.
phpunit/php-token-stream              1.4.11      2.0.2       Wrapper around PHP's tokenizer extension.
phpunit/phpunit                       4.8.36      6.5.5       The PHP Unit Testing framework.
phpunit/phpunit-mock-objects          2.3.8       5.0.6       Mock Object library for PHPUnit
sebastian/comparator                  1.2.4       2.1.1       Provides the functionality to compare PHP values for equality
sebastian/diff                        1.4.3       2.0.1       Diff implementation
sebastian/environment                 1.3.8       3.1.0       Provides functionality to handle HHVM/PHP environments
sebastian/exporter                    1.2.2       3.1.0       Provides the functionality to export PHP variables for visualization
sebastian/global-state                1.1.1       2.0.0       Snapshotting of global state
sebastian/recursion-context           1.0.5       3.0.0       Provides functionality to recursively process PHP variables
sebastian/version                     1.0.6       2.0.1       Library that helps with managing the version number of Git-hosted PHP projects
symfony-cmf/routing                   1.4.1       2.0.3       Extends the Symfony2 routing component for dynamic routes and chaining several routers
symfony/browser-kit                   v3.3.10     v4.0.3      Symfony BrowserKit Component
symfony/class-loader                  v3.2.14     v3.4.3      Symfony ClassLoader Component
symfony/config                        v3.2.14     v4.0.3      Symfony Config Component
symfony/console                       v3.2.14     v4.0.3      Symfony Console Component
symfony/css-selector                  v3.3.10     v4.0.3      Symfony CssSelector Component
symfony/debug                         v3.4.3      v4.0.3      Symfony Debug Component
symfony/dependency-injection          v3.2.14     v4.0.3      Symfony DependencyInjection Component
symfony/dom-crawler                   v3.4.3      v4.0.3      Symfony DomCrawler Component
symfony/event-dispatcher              v3.2.14     v4.0.3      Symfony EventDispatcher Component
symfony/expression-language           v3.4.3      v4.0.3      Symfony ExpressionLanguage Component
symfony/filesystem                    v3.4.3      v4.0.3      Symfony Filesystem Component
symfony/finder                        v3.4.3      v4.0.3      Symfony Finder Component
symfony/http-foundation               v3.2.14     v4.0.3      Symfony HttpFoundation Component
symfony/http-kernel                   v3.2.14     v4.0.3      Symfony HttpKernel Component
symfony/process                       v3.2.14     v4.0.3      Symfony Process Component
symfony/routing                       v3.2.14     v4.0.3      Symfony Routing Component
symfony/serializer                    v3.2.14     v4.0.3      Symfony Serializer Component
symfony/translation                   v3.2.14     v4.0.3      Symfony Translation Component
symfony/validator                     v3.2.14     v4.0.3      Symfony Validator Component
symfony/var-dumper                    v3.4.3      v4.0.3      Symfony mechanism for exploring and dumping PHP variables
symfony/yaml                          v3.2.14     v4.0.3      Symfony Yaml Component
twig/twig                             v1.35.0     v2.4.4      Twig, the flexible, fast, and secure template language for PHP
webflo/drupal-finder                  1.0.0       1.1.0       Helper class to locate a Drupal installation from a given path.

This is a fairly vanilla Drupal install. I only have a few modules added and one theme. I should probably also mention that this site was build using the drupal-composer template mentioned in the official docs (https://github.com/drupal-composer/drupal-project).

Improve this question
3
  • 2
    Its difficult to say what should be updated without knowing what you have installed - composer show --tree will display the dependency tree, browsing that might help you determine what requires the packages that need to be updated and inform a decision. You also might find github.com/webflo/drupal-core-strict useful, it fixes core dependencies to known good versions which might help you update with more confidence
    – Clive ♦
    Jan 9, 2018 at 20:53
  • From my limited experience: It's OK to have some outdated packages, as Drupal usually publishes security advisories when one of their core dependencies has an issue. But so far I also had no problem with updating without limiting to drupal/core... Symfony packages never made any problems with composer update, but I definitly can NOT say that from Drupal modules!
    – Hudri
    Jan 10, 2018 at 9:44
  • @Hudri, So I'm guessing I can just use the generic composer update command and rely on the composer.json file to keep the packages compatible (at least with the core)? And then if stuff breaks on dev during an update, I just walk through each package update and find out what's causing the issue. Seems to make sense.
    – Cloudkiller
    Jan 10, 2018 at 15:34

2 Answers 2

Reset to default
4

Honestly, for a codebase like your typical Drupal site, this is a hard problem to solve. Take, for instance, my Drupal VM Prod codebase, which I just upgraded from Drupal core 8.4.5 to 8.5.0 yesterday:

  • My drupal/core version constraint in composer.json is ~8.4
  • Running composer update drupal/core --with-dependencies didn't update Drupal core; it was stuck at 8.4.5
  • Running composer update (more of the nuclear option—it will update everything, including contrib modules and any other dependencies, which could cause issues and make it way harder to test individual updates on a complex site!) worked to upgrade Drupal core... but that's not ideal.

So I asked about it in the issue composer fail to upgrade from 8.4.4 to 8.5.0-alpha1, and even tried to figure out which dependency was blocking my Drupal core upgrade using the Composer command:

composer prohibits drupal/core:8.5.0

This listed off a ton of different symfony components... so I could've sat there and copy-pasted each of the 14 components into my composer update command, but that is not fun to do, so I kept poking around (to no avail).

Later in the comment thread, @eiriksm mentioned that since my project has symfony/config (a dependency of drush and drupal console), I needed to run composer update drupal/core symfony/config --with-dependencies.

I still have no idea how I could've figured out I just needed to add symfony/config in the update command (vs adding all the other symfony components)... but if I do, I'll try to update this answer with that information so others can benefit in the future!

Improve this answer
1
2

Updating minor versions (8.3 > 8.4, 8.4 > 8.5) with composer is a nightmare.

I am coming to the conclusion that maybe composer update should be "embraced" and that one should manage module versions carefully in composer.json perhaps locking them all to the currently installed versions, then changing the version only when you want to update the module. That is really not that big a deal to do.

That is really how we did it before composer. We decided what module to update one by one, not all at once, with drush up modulename or whatever.

This could mean installing modules with specific version numbers is a good idea:

composer require "drupal/address:1.0"

not this

composer require "drupal/address:~1.0"

You can always change "~1.0" to "1.0" later in composer.json, but if you install a specific version number, you won't need to.

Improve this answer
2
  • 2
    Updating minor versions (8.3 > 8.4, 8.4 > 8.5) with composer is a nightmare. I've done about 10 8.4 -> 8.5 updates in the last week, all through composer, all as simple as running composer update, no problems with any of them. I'm not sure what combination of things is making people struggle with this, I haven't hit a single problem with Drupal/Composer yet
    – Clive ♦
    Apr 3, 2018 at 12:10
  • 3
    @Clive if you just want to update Drupal Core, and not all of core, contrib, and all other dependencies, and you're not locking in a specific version for every other thing besides Core... composer update can have very many unintended consequences. For many sites, it is usually safe enough to update everything all the time, but for some it can be a disaster. Always test before going to production!
    – geerlingguy
    May 8, 2018 at 1:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.