I’ve installed several Drupal 8 site with composer as it is strongly recommended.

I can update modules like this :

composer require drupal/pathauto:1.1

But I can't update core with

composer update drupal/core --with-dependencies (as seen in documentation)

or (think should be like this in my case) :

composer update drupal/drupal --with-dependencies

I try tu update from 8.4.2 to 8.5.0 in this website.

I’ve read a lot of topics on this, I’ve tried :

  • remove folder /vendor
  • remove composer.lock

But it didn’t work.

How can I update my classic Drupal (nothing fancy in it) with composer ? Should I gave up and update with Drush ?

Her is my composer.json

    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.24",
        "wikimedia/composer-merge-plugin": "^1.4",
        "drupal/contact_block": "^1.4",
        "drupal/twig_tweak": "^1.9",
        "drupal/contact_ajax": "^1.4@beta",
        "drupal/pathauto": "1.1",
        "drupal/easy_breadcrumb": "^1.6",
        "drupal/redirect": "1.1",
        "drupal/views_slideshow": "^4.6",
        "drupal/bootstrap": "3.11",
        "drush/drush": "dev-master"
    "replace": {
        "drupal/core": "^8.4"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php.",
            "This file specifies the packages.drupal.org repository.",
            "You can read more about this composer repository at:",
        "merge-plugin": {
            "include": [
            "recurse": false,
            "replace": false,
            "merge-extra": false
        "installer-paths": {
            "core": ["type:drupal-core"],
            "modules/contrib/{$name}": ["type:drupal-module"],
            "profiles/contrib/{$name}": ["type:drupal-profile"],
            "themes/contrib/{$name}": ["type:drupal-theme"],
            "drush/contrib/{$name}": ["type:drupal-drush"],
            "modules/custom/{$name}": ["type:drupal-custom-module"],
            "themes/custom/{$name}": ["type:drupal-custom-theme"]
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": [
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"

Finally, i could update with these modifications.

Step 1, optional in case your composer.jsoncontains this. If it is ok, apply step 2


"require": {
        "drupal/core": "~8.5"


"replace": {
    "drupal/core": "^8.4"

Step 2

delete this folder :


delete this file :



composer update --with-dependencies
  • 1
    For me this worked without the option "--with-dependencies". I believe that an unqualified "composer update" does update the dependencies anyway. See getcomposer.org/doc/03-cli.md#update – Feodor Mar 19 '18 at 17:51

In your "require" section, change the version from drupal/core:"8.4" to drupal/core:"8.5" and run composer update

  • 1
    Do I have to change this manually each time I want to update or was is an issue with composer.json ? – Sébastien Gicquel Mar 15 '18 at 13:31
  • Thanks, I’ve tested and like I said in my previous answer, I had also to delete vendor and composer.lock (require is necessary but not enough) – Sébastien Gicquel Mar 15 '18 at 14:03

protected by kiamlaluno Jan 8 at 9:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.