I want to confirm some behavior of Composer to see if this is a limitation of Composer or something I did wrong.

This is based on an issue in the Markdown module queue.

Basically, here's the issue.

  1. The Markdown module requires ^0.15 of a library.
  2. I wrote a patch to require ~0.15 of the library. (to allow 0.16, 0.17, etc.)

But, when I apply this patch via Composer, and then try to update the library, I still get a drupal/markdown 1.2.0 requires league/commonmark (^0.15.0) even though the module's (patched) code on my site requires ~0.15.

So, is there no way to "patch" a composer.json so that it will be picked up for composer update? Am I reliant on the module maintainer to commit the patch?

1 Answer 1


This issue is actually addressed in the composer-patches documentation:

Because patching occurs after Composer calculates dependencies and installs packages, changes to an underlying dependency's composer.json file introduced in a patch will have no effect on installed packages.

If you need to modify a dependency's composer.json or its underlying dependencies, you cannot use this plugin. Instead, you must do one of the following:

  • Work to get the underlying issue resolved in the upstream package.
  • Fork the package and specify your fork as the package repository in your root composer.json
  • Specify compatible package version requirements in your root composer.json

If you want to follow option #2, you can fork the project's git repo, modify it, and add the forked repo to your project's repositories property:

        "url": "https://github.com/vendor/module"

So you can reference that dependency until the upstream has resolved the issue.

  • 2
    Worth mentioning that when doing so the branch must be prefixed dev-. No matter how its actual name is. After you added the repository your custom branch should appear prefixed with dev- prefix when executing $ composer show "vendor/module" --all.
    – leymannx
    Jan 23, 2020 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.