I'm just starting to work with Drupal 8 and composer and I'm trying to figure out how the updating workflow should work. I know the basics from administering a Drupal 7 server for years, but the Composer part is tripping me up.
Right now I run, from the root folder of my Drupal install, (with maintenance mode enabled)
composer outdated and I get a list of a bunch of packages in need of an update.
As far as I can tell from the documentation, I should only be updating the packages that start with "drupal/". Assuming just the console and core come up as outdated, I run
composer update drupal/console drupal/core --with-dependencies and that pulls down the updates, and does its thing. After this is done, if I run
composer outdated again, I still see a bunch of packages that are outdated according to composer. Is that intended? Or should these packages be updated?
I'm guessing Drupal is built using specific versions of packages, so updating all of them would probably break some stuff, right? How is someone supposed to know what packages should be updated and which ones should stay at a specific version?
This is what I get when I run
alchemy/zippy 0.4.3 0.4.8 Zippy, the archive manager companion composer/installers v1.4.0 v1.5.0 A multi-framework Composer library installer consolidation/annotated-command 2.8.1 2.8.2 Initialize Symfony Console commands from annotated command class methods. consolidation/output-formatters 3.1.12 3.1.13 Format text by applying transformations provided by plug-in formatters. cweagans/composer-patches 1.6.2 1.6.4 Provides a way to patch Composer packages. dflydev/dot-access-data v1.1.0 v2.0.0 Given a deep data structure, access data by dot notation. drupal/php 1.0.0-beta1 1.0.0-beta2 Allows embedded PHP code/snippets to be evaluated. Enabling this can cause security and performance issues as it allows users to execute PHP code on your site. egulias/email-validator 1.2.14 2.1.3 A library for validating emails fabpot/goutte v3.2.1 v3.2.2 A simple PHP Web Scraper gabordemooij/redbean v4.3.4 v5.0 RedBeanPHP ORM jcalderonzumba/gastonjs v1.0.3 v1.2.0 PhantomJS API based server for webpage automation phpdocumentor/reflection-docblock 2.0.5 4.2.0 phpspec/prophecy v1.7.2 1.7.3 Highly opinionated mocking framework for PHP 5.3+ phpunit/php-code-coverage 2.2.4 5.3.0 Library that provides collection, processing, and rendering functionality for PHP code coverage information. phpunit/php-file-iterator 1.4.2 1.4.5 FilterIterator implementation that filters files based on a list of suffixes. phpunit/php-token-stream 1.4.11 2.0.2 Wrapper around PHP's tokenizer extension. phpunit/phpunit 4.8.36 6.5.5 The PHP Unit Testing framework. phpunit/phpunit-mock-objects 2.3.8 5.0.6 Mock Object library for PHPUnit sebastian/comparator 1.2.4 2.1.1 Provides the functionality to compare PHP values for equality sebastian/diff 1.4.3 2.0.1 Diff implementation sebastian/environment 1.3.8 3.1.0 Provides functionality to handle HHVM/PHP environments sebastian/exporter 1.2.2 3.1.0 Provides the functionality to export PHP variables for visualization sebastian/global-state 1.1.1 2.0.0 Snapshotting of global state sebastian/recursion-context 1.0.5 3.0.0 Provides functionality to recursively process PHP variables sebastian/version 1.0.6 2.0.1 Library that helps with managing the version number of Git-hosted PHP projects symfony-cmf/routing 1.4.1 2.0.3 Extends the Symfony2 routing component for dynamic routes and chaining several routers symfony/browser-kit v3.3.10 v4.0.3 Symfony BrowserKit Component symfony/class-loader v3.2.14 v3.4.3 Symfony ClassLoader Component symfony/config v3.2.14 v4.0.3 Symfony Config Component symfony/console v3.2.14 v4.0.3 Symfony Console Component symfony/css-selector v3.3.10 v4.0.3 Symfony CssSelector Component symfony/debug v3.4.3 v4.0.3 Symfony Debug Component symfony/dependency-injection v3.2.14 v4.0.3 Symfony DependencyInjection Component symfony/dom-crawler v3.4.3 v4.0.3 Symfony DomCrawler Component symfony/event-dispatcher v3.2.14 v4.0.3 Symfony EventDispatcher Component symfony/expression-language v3.4.3 v4.0.3 Symfony ExpressionLanguage Component symfony/filesystem v3.4.3 v4.0.3 Symfony Filesystem Component symfony/finder v3.4.3 v4.0.3 Symfony Finder Component symfony/http-foundation v3.2.14 v4.0.3 Symfony HttpFoundation Component symfony/http-kernel v3.2.14 v4.0.3 Symfony HttpKernel Component symfony/process v3.2.14 v4.0.3 Symfony Process Component symfony/routing v3.2.14 v4.0.3 Symfony Routing Component symfony/serializer v3.2.14 v4.0.3 Symfony Serializer Component symfony/translation v3.2.14 v4.0.3 Symfony Translation Component symfony/validator v3.2.14 v4.0.3 Symfony Validator Component symfony/var-dumper v3.4.3 v4.0.3 Symfony mechanism for exploring and dumping PHP variables symfony/yaml v3.2.14 v4.0.3 Symfony Yaml Component twig/twig v1.35.0 v2.4.4 Twig, the flexible, fast, and secure template language for PHP webflo/drupal-finder 1.0.0 1.1.0 Helper class to locate a Drupal installation from a given path.
This is a fairly vanilla Drupal install. I only have a few modules added and one theme. I should probably also mention that this site was build using the drupal-composer template mentioned in the official docs (https://github.com/drupal-composer/drupal-project).
composer show --treewill display the dependency tree, browsing that might help you determine what requires the packages that need to be updated and inform a decision. You also might find github.com/webflo/drupal-core-strict useful, it fixes core dependencies to known good versions which might help you update with more confidence
composer updatecommand and rely on the composer.json file to keep the packages compatible (at least with the core)? And then if stuff breaks on dev during an update, I just walk through each package update and find out what's causing the issue. Seems to make sense.