I want to build a site broadly based on an exiting site and was thinking that the best way to do this would be to copy and paste required modules from the existing site composer.json and paste them into the new composer.json. What would be the correct command to download the modules via Composer once the file has been amended?

I think composer update is the command, but I don't know if it also updates dependencies that should not be updated.


You are better off calling composer require some/library. This will update the files accordingly and install the library as well. That said, you can run composer install after manually editing composer.json.

  • 1
    composer install works based on composer.lock, not based on composer.json. So composer install will not work after manually editing composer.json, you have to use composer require some/library
    – Hudri
    Mar 4 '19 at 16:54
  • composer install brings the composer.json and composer.lock files in line with each other. composer install will work after manually editing composer.json, unless the change you made was one that does not require any update to the project, though I cannot think of any examples where that would be the case. You can determine if you need to run composer install by running composer validate. If you can find any examples where composer.json is manually edited and composer install does not do anything, please post them here.
    – Jaypan
    Mar 4 '19 at 20:31
  • 2
    composer install does not handle changes in version requirements in composer.json, it will use the version information as stored in the lock file. E.g. if you do a downgrade from some/library:^2.1 to some/libarary:2.0 in composer.json, it will not downgrade the version
    – Hudri
    Mar 5 '19 at 7:42
  • Thank you Hudri, that was also my experience, yet a few times I got criticized why did I use composer update when I needed only to install, thus install didn't do a dime alongside the composer.lock, though maybe the solution could be erasing composer.lock temporarily, though it could have drawbacks, like loosing the very specific versions of dependencies, thus beside probably also bypassing the cache, etc
    – FantomX1
    Oct 18 '19 at 18:47

Yes, after editing composer.json run composer update. If it update things you don't want then add more restrictive version constraints for those packages. To use composer most efficiently your project should be in a state where you can use composer update after editing composer.json. If not rollback and try again.


Erase a composer.lock file temporarily, though it could have its own drawbacks, like loosing the very specific version numbers of dependencies, thus beside probably also bypassing the cache and being slower, yet, it fulfills the requirements of having those concrete versions, questionable is if the very exact commit instances necessarily as in composer.lock file. On the other side, dependencies should be written in such a way, that it should be easily upgradable and preferrable to update any time without breaking some dependency - minors are not breaking versions.

Though sometimes, like changing composer JSON configuration like a platform or minimum stability requirements you often than not don't have other chance than just editing and actualizing the file manually.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.