I am working on a drupal 8 site and tend to update some modules:

  1. I run the composer outdated 'drupal/*' command and it shows me the list of modules need update.
  2. Running composer update drupal/module_name --with-dependencies end up with discard changes output.
  3. So I choose to update the module from admin interface, after updating db changes, the status report not shows any update anymore but running outdated command in composer list the modules again.

This means I somehow need to announce to composer about this manual update (I think by changing composer.json and/or composer.lock, but I did not find the flow of it, yet.

  • Why are you doing this? What do you mean by "end up with discard changes output"? Why don't you discard them then? You know about the discard changes config in your Composer file and the -n flag?
    – leymannx
    Apr 26, 2020 at 7:09
  • For #2 maybe the module is set to a fixed version number in your composer.json which would explain why it doesn't update to the lstest version.
    – No Sssweat
    Apr 26, 2020 at 8:26

1 Answer 1


Yes, in the sense if you want to hack composer.lock you can make Composer think it got updates it never downloaded.

That requires you to know what composer.lock properties have changed (like content-hash & packages[*]) and apply them manually to the file.

That said, doing this is breaking the entire purpose of Composer (composer.json represents a manifest of what you need & composer.lock represents a manifest of what Composer retrieved); you run the risk of breaking of what composer.lock should do (i.e. composer install on any machine will retrieve the exact same files as when you made your last updates); so you should really think about the impacts on other environments/hosts that use your composer.* files.

If you're committing to a Composer-driven process, it's better to troubleshoot why your dependencies aren't updating as other commentators have suggested (e.g. too broad versioning in composer.json, auto-dropped changes from a non-interactive run)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.