I'm going through the nightmare of trying to update a site to 8.4.4 from 8.3.2. It seems like the best way forward is to delete vendors and composer.lock and let composer replace everything. However, when I do this, it also goes through and replaces all of my module folders as well. A number of them are patched, so replacing them straight out of the gate simply doesn't work.

Is this normal behavior for composer? Is there some way to specify that I only want to replace what's going into the vendor directory?

  • Drupal 8.4 requires using composer for your core, vendor, themes and modules. On top of that you can add custom modules/themes. You should include all your modules with the correct versions in your composer.json file. Then, specify paths to all your patches (locally, or remote). With this structure, you can run composer update at any time: it will have some kind of versioning of all your dependencies and will patch all your code again. It is a much more structured, and professional way of working. A bit hard at first, but once you get going you'll see the benefits. Commented Jan 24, 2018 at 9:03
  • I've got the composer.json set up for everything already and developed the site with it in mind, except that I didn't realize there was a way to include patches in the mix. At this point I'm not sure how I'd account for them. I'm not opposed to using composer -- I just need to know how to use it in a way that won't nuke my files.
    – Mrweiner
    Commented Jan 24, 2018 at 9:06
  • I've included an example: drupal.stackexchange.com/a/254371/71941 Commented Jan 24, 2018 at 9:16

2 Answers 2


Is this normal behavior for composer?


Is there some way to specify that I only want to replace what's going into the vendor directory?

Sure, remove the reference to the module(s) from composer.json. Obviously at that point you’ll need to manage any updates for them yourself.

A better resolution would be to install Composer patches, and patch the modules automatically as they’re being installed/updated.


Inside the "extra" section of your composer.json, you can specify paths to patches (locally or remote). After running 'composer update' your modules will be patched automatically:

"enable-patching": true,
"patches": {
  "drupal/core": {
    "Content translation bug": 
  "drupal/paragraphs": {
    "Inline editing fix": "patches/paragraphs_fix.patch"
  • 1
    This only works if you install the relevant package, it won’t work out of the box with composer
    – Clive
    Commented Jan 24, 2018 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.