Every time I try to update anything using Composer, it overwrites a load of files. One of the files it overwrites is .htaccess, which I have customised, so I have to keep patching it all the time. Here's an example (below) of it doing this even when package I asked to update didn't need updating. I'm guessing it's because I used the "drupal/core-composer-scaffold" package to create the site. I did that because I was following these instructions: https://www.drupal.org/docs/develop/using-composer/using-composer-to-install-drupal-and-manage-dependencies#composer-from-scratch.

What am I doing wrong, to make it keep scaffolding (if that's the word for it) repeatedly? Thanks.

~/sites/default$ composer update drupal/security_review
Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update
Package academicpuma/citeproc-php is abandoned, you should avoid using it. Use seboettg/citeproc-php instead.
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package technosophos/LibRIS is abandoned, you should avoid using it. No replacement was suggested.
Package zendframework/zend-diactoros is abandoned, you should avoid using it. Use laminas/laminas-diactoros instead.
Package zendframework/zend-escaper is abandoned, you should avoid using it. Use laminas/laminas-escaper instead.
Package zendframework/zend-feed is abandoned, you should avoid using it. Use laminas/laminas-feed instead.
Package zendframework/zend-stdlib is abandoned, you should avoid using it. Use laminas/laminas-stdlib instead.
Writing lock file
Generating autoload files
Scaffolding files for drupal/core:
  - Copy [project-root]/.editorconfig from assets/scaffold/files/editorconfig
  - Copy [project-root]/.gitattributes from assets/scaffold/files/gitattributes
  - Copy [web-root]/.csslintrc from assets/scaffold/files/csslintrc
  - Copy [web-root]/.eslintignore from assets/scaffold/files/eslintignore
  - Copy [web-root]/.eslintrc.json from assets/scaffold/files/eslintrc.json
  - Copy [web-root]/.ht.router.php from assets/scaffold/files/ht.router.php
  - Copy [web-root]/.htaccess from assets/scaffold/files/htaccess
  - Copy [web-root]/example.gitignore from assets/scaffold/files/example.gitignore
  - Copy [web-root]/index.php from assets/scaffold/files/index.php
  - Copy [web-root]/INSTALL.txt from assets/scaffold/files/drupal.INSTALL.txt
  - Copy [web-root]/README.txt from assets/scaffold/files/drupal.README.txt
  - Copy [web-root]/robots.txt from assets/scaffold/files/robots.txt
  - Copy [web-root]/update.php from assets/scaffold/files/update.php
  - Copy [web-root]/web.config from assets/scaffold/files/web.config
  - Copy [web-root]/sites/README.txt from assets/scaffold/files/sites.README.txt
  - Copy [web-root]/sites/development.services.yml from assets/scaffold/files/development.services.yml
  - Copy [web-root]/sites/example.settings.local.php from assets/scaffold/files/example.settings.local.php
  - Copy [web-root]/sites/example.sites.php from assets/scaffold/files/example.sites.php
  • 2
    There is nothing wrong with this, this is done by concept. You can either extend or patch .htaccess using the extra/drupal-scaffold section in your composer.json, see docs Using this Drupal will then automatically add your modifications after scaffolding.
    – Hudri
    Feb 11, 2020 at 19:15
  • 2
    Just wait :). This will be fixed on the next Drupal Core release (8.9). See drupal.org/project/drupal/issues/3103090
    – xaa
    Feb 25, 2020 at 7:38

1 Answer 1


That's Drupal's Composer Scaffold. Listed as "drupal/core-composer-scaffold": "^8.8.0" or a different version in your project's composer.json file.

To prevent certain scaffold files from being overwritten every time you run a Composer command you need to specify them one by one in the "extra" section of your project's composer.json. See the docs on Excluding scaffold files.

The following snippet prevents the .htaccess and the development.services.yml from being overwritten.

"drupal-scaffold": {
    "locations": {
        "web-root": "web/"
    "file-mapping": {
        "[web-root]/.htaccess": false,
        "[web-root]/sites/development.services.yml": false

But maybe you want to ensure you always get Drupal's latest .htaccess for security updates for example. For that you don't exclude this file from Drupal Scaffold but you patch it instead. See the docs on Altering scaffold files.

Create a patch of the .htaccess and maybe put it in a folder called "patches" in your project root. Then configure a "post-drupal-scaffold-cmd" in the "scripts" section of your composer.json file to have this patch applied to Drupal's core .htaccess every time Drupal scaffolding is triggered.

"scripts": {
    "post-drupal-scaffold-cmd": [
        "cd web && patch -p1 < ../patches/htaccess-ssl.patch"
  • 1
    cweagans/composer-patches can also handle the last bit, which I think is still added by default in drupal-composer/drupal-project
    – mpdonadio
    Feb 13, 2020 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.