I am running Drupal 8.5.1, with php 7.2 and a new security update 8.5.2 was just released. Per the documentation, I should be able to update Drupal core with composer.

I ran the following command:

composer update drupal/core --with-dependencies

I keep getting :

Nothing to install or update Generating autoload files Drupal\Core\Composer\Composer::preAutoloadDump Drupal\Core\Composer\Composer::ensureHtaccess

Has anyone have any luck updating a drupal site with composer? I usually update my Drupal sites manually but this is getting tiring. I do not trust drush for my updates.

  • I am running composer version 1.6.3, Ubuntu 16.04
    – winteck
    Commented Apr 21, 2018 at 7:22

1 Answer 1


You can try to delete the vendor directory and the composer.lock file, and then run the update again.


  • You need to add the line "drupal/core": "~8.5.2" to the 'require' statement (or update it to whatever version you require).

  • Then remove the drupal/core line from the 'replace' statement.

  • Add the following line somewhere (at the end? I believe this should replace the existing repositories statement):

    "repositories": { "drupal": { "type": "composer", "url": "https://packages.drupal.org/8" } }

Then delete the vendor and composer.lock, and try again.

It should work.

  • I removed the vendor folder and the compose.lock file and rerun the command but that did NOT work.
    – winteck
    Commented Apr 21, 2018 at 7:18
  • Try to look at the update
    – user72672
    Commented Apr 21, 2018 at 7:22
  • I followed your update directives: 1 i added this line to the require section: "drupal/core": "^8.5.2" . 2. I removed the 'replace' statement and i already had the repositories set. 3. I deleted the vendor folder and composer.lock. and Voila it got the new updates. Thanks @jdrupal
    – winteck
    Commented Apr 21, 2018 at 7:29
  • Nuking vendor and lockfile seems like a last resort IMO. This was probably a version specification mismatch.
    – Kevin
    Commented Apr 22, 2018 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.