I have been going through and updating my drupal sites after the announcement of CVE-2018-7600.

All have gone smoothly except for one site that was running Drupal 8.4.4

I updated the site following the composer/drush method. This finished successfully.

When I access the sites admin section I still get the warning of a critical update and the Available Updates page states that the currently installed version is still 8.4.4.

I have tried re-running the composer/drush commands, composer returns Nothing to install or update and drush returns No database changes required. I have also executed vendor/bin/drush cr to rebuild the cache. Navigating to /update.php in the browser returns a green No pending updates. page. I have also tried logging out and back in, as well as clearing browser cache.

Is there anything else I can do? Is my site updated and just not displaying correctly in the front end, or is the site still vulnerable?

Edit: Here is the contents of my composer.json file:

    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.24",
        "wikimedia/composer-merge-plugin": "^1.4",
        "drush/drush": "^9.2"
    "replace": {
        "drupal/core": "^8.5"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php.",
            "This file specifies the packages.drupal.org repository.",
            "You can read more about this composer repository at:",
        "merge-plugin": {
            "include": [
            "recurse": false,
            "replace": false,
            "merge-extra": false
        "installer-paths": {
            "core": ["type:drupal-core"],
            "modules/contrib/{$name}": ["type:drupal-module"],
            "profiles/contrib/{$name}": ["type:drupal-profile"],
            "themes/contrib/{$name}": ["type:drupal-theme"],
            "drush/contrib/{$name}": ["type:drupal-drush"],
            "modules/custom/{$name}": ["type:drupal-custom-module"],
            "themes/custom/{$name}": ["type:drupal-custom-theme"]
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": [
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"
  • What does composer show drupal/core return? It'll output a bunch of stuff, but just looking to see if the 4th line says versions: 8.5.1
    – sonfd
    Apr 4 '18 at 0:31
  • 1
    @sonfd it says [Invalid argument exception] Package drupal/core not found I will update the OP with the contents of my composer.json file.
    – Jake
    Apr 4 '18 at 0:48
  • You may need to update to using something like drupal-composer/drupal-project. See: drupal.stackexchange.com/questions/217394/…
    – sonfd
    Apr 4 '18 at 1:06
  • I followed the top comment and get the same error as the comment there... There are no commands defined in the https namespace when trying to run composer https://packages.drupal.org/8 the output from the first command is: {"type":"composer","url":"https:\/\/packages.drupal.org\/8"}
    – Jake
    Apr 4 '18 at 1:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.