I got a notice to update composer to 2.0 today and gave it a try, using "composer self-update --2". Now when I run composer update, I'm seeing this message.

The "grasmash/composerize-drupal" plugin was skipped because it requires a Plugin API version ("^1.0.0") that does not match your Composer installation ("2.0.0"). You may need to run composer update with the "--no-plugins" option.

I then tried installing colorbox and see "drupal/colorbox": "^1.6" in composer.json, but it does not appear when I refresh the extend page; is this related to the above problem?

Next, I tried updating core from 8.9.6 to 8.9.7, following a message I saw, I tried composer update drupal/core-recommended --with-dependencies -W --no-plugins and now I see this message.

  Problem 1
    - Root composer.json requires composer/installers ^1.2 -> satisfiable by composer/installers[v1.7.0].
    - composer/installers v1.7.0 requires composer-plugin-api ^1.0 -> found composer-plugin-api[2.0.0] but it does not match the constraint.
  Problem 2
    - composer/installers v1.7.0 requires composer-plugin-api ^1.0 -> found composer-plugin-api[2.0.0] but it does not match the constraint.
    - signature_pad/signature_pad 2.3.0 requires composer/installers ~1.0 -> satisfiable by composer/installers[v1.7.0].
    - signature_pad/signature_pad is locked to version 2.3.0 and an update of this package was not requested.

I don't understand all these errors, and I am afraid to do anything else. How do I get out of this without reverting composer to 1.x?

3 Answers 3


In order to resolve the composer/installers ^1.7 issue you can require composer/installers ^1.9. More details can be found from Drupal's Preparing your site for Composer 2.

composer require "composer/installers:^1.9"

First of all, instead of being afraid of losing everything, you should back up your site.

You should never make changes to composer using the only copy of your site; it's highly unnecessary risk. Always make changes to a copy of the site first.

Next, the warning about the Plugin API version ("^1.0.0") means that you need to use Composer 1.x with that plugin; it's not ready for 2.x.

So you have to either update the plugin, remove the plugin, or revert to Composer 1.x.

If you look at the plugin's repo, you see that the current version is still requiring 1.x (as of November 1, 2020). So your choice is to remove the plugin or revert to composer 1.x.

I would try removing the plugin, deleting composer.lock and the vendor directory, and then running composer update.

Or, you can just go back to Composer 1.x for now. If you immediately update whenever you get an update notice, you can often have problems like this, so if you're not confident about handling the errors, you can wait awhile until plugins and modules get updated to support new versions.

  • Thanks; this is my dev site, not the main one, and I did back everything up, thanks for the reminder. Not sure where the Plugins are, so I reverted to composer 1.10.17. But even though I see a few contribs that need updating, they don't get updated when I run composer update. I've been using Drupal since vern 5, but the new config mgt, leaves me confused a lot. I used to be able to run composer update and see modules get updated. Also, when I try to use composer to require colorbox, I see it mentioned in composer.json and composer.lock, but don't see it mentioned on the extend page.
    – pglatz
    Commented Nov 2, 2020 at 0:56
  • 1
    @pglatz If contribs aren't updating, 1. Check composer.json and make sure the version constraint is correct; you might have accidentally limited which versions it can update to. 2. Delete composer.lock and the vendordirectory and try again. 3. Try composer why and composer why-not to see what is messed up (getcomposer.org/doc/03-cli.md#depends-why-) Commented Nov 2, 2020 at 14:33
  • Thanks, #2 worked!
    – pglatz
    Commented Nov 2, 2020 at 20:03

grasmash/composerize-drupal is used to convert a Drupal site that wasn't created with Composer into a Drupal site managed with Composer.
Once the plugin converted the site, it can be removed. After the plugin is removed, modules and themes must be added with composer require, not downloading the archive containing the module/theme files.

If that is the only plugin that isn't compatible with Composer 2.x, you can remove it, as it's not necessary to keep it installed.
Drupal 8.9 is compatible with Composer 2.x; it should not create issues with that Composer version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.