I’ve installed several Drupal 8 site with composer as it is strongly recommended.

I can update modules like this :

composer require drupal/pathauto:1.1

But I can't update core with

composer update drupal/core --with-dependencies (as seen in documentation)

or (think should be like this in my case) :

composer update drupal/drupal --with-dependencies

I try tu update from 8.4.2 to 8.5.0 in this website.

I’ve read a lot of topics on this, I’ve tried :

  • remove folder /vendor
  • remove composer.lock

But it didn’t work.

How can I update my classic Drupal (nothing fancy in it) with composer ? Should I gave up and update with Drush ?

Her is my composer.json

    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.24",
        "wikimedia/composer-merge-plugin": "^1.4",
        "drupal/contact_block": "^1.4",
        "drupal/twig_tweak": "^1.9",
        "drupal/contact_ajax": "^1.4@beta",
        "drupal/pathauto": "1.1",
        "drupal/easy_breadcrumb": "^1.6",
        "drupal/redirect": "1.1",
        "drupal/views_slideshow": "^4.6",
        "drupal/bootstrap": "3.11",
        "drush/drush": "dev-master"
    "replace": {
        "drupal/core": "^8.4"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php.",
            "This file specifies the packages.drupal.org repository.",
            "You can read more about this composer repository at:",
        "merge-plugin": {
            "include": [
            "recurse": false,
            "replace": false,
            "merge-extra": false
        "installer-paths": {
            "core": ["type:drupal-core"],
            "modules/contrib/{$name}": ["type:drupal-module"],
            "profiles/contrib/{$name}": ["type:drupal-profile"],
            "themes/contrib/{$name}": ["type:drupal-theme"],
            "drush/contrib/{$name}": ["type:drupal-drush"],
            "modules/custom/{$name}": ["type:drupal-custom-module"],
            "themes/custom/{$name}": ["type:drupal-custom-theme"]
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": [
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"

2 Answers 2


Finally, i could update with these modifications.

Step 1, optional in case your composer.jsoncontains this. If it is ok, apply step 2


"require": {
        "drupal/core": "~8.5"


"replace": {
    "drupal/core": "^8.4"

Step 2

delete this folder :


delete this file :



composer update --with-dependencies
  • 1
    For me this worked without the option "--with-dependencies". I believe that an unqualified "composer update" does update the dependencies anyway. See getcomposer.org/doc/03-cli.md#update
    – Feodor
    Commented Mar 19, 2018 at 17:51
  • For me this worked too. I had to remove composer.lock and vendor folder. I didnt change the version numbers in my composer.json files though.
    – Robbiegod
    Commented Mar 4, 2020 at 19:47

In your "require" section, change the version from drupal/core:"8.4" to drupal/core:"8.5" and run composer update

  • 1
    Do I have to change this manually each time I want to update or was is an issue with composer.json ? Commented Mar 15, 2018 at 13:31
  • Thanks, I’ve tested and like I said in my previous answer, I had also to delete vendor and composer.lock (require is necessary but not enough) Commented Mar 15, 2018 at 14:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.