I have a Drupal 8.9.16 website and when I try running composer update to update the modules, I get this output

$ composer update
Loading composer repositories with package information
Updating dependencies
Nothing to modify in lock file
Installing dependencies from lock file (including require-dev)
Nothing to install, update or remove
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package doctrine/reflection is abandoned, you should avoid using it. Use roave/better-reflection instead.
Generating autoload files
38 packages you are using are looking for funding.
Use the `composer fund` command to find out more!

So it says Nothing to install, update or remove.

Then I look at the list of available updates in the Available updates page (/admin/reports/updates) and most of them have updates.

Looking at the composer.json file, I see it listing the updated version.

For example:

  • Drupal's Available updates page says I have Address 8.x-1.8 installed and recommends version 8.x-1.9.
  • The composer.json file shows under require: "drupal/address": "^1.9", which I assume means composer says to update to version 1.9.

I was getting this problem in Composer 1, so I updated to Composer 2 but that hasn't changed anything.

$ composer --version
Composer version 2.1.3 2021-06-09 16:31:20

Below is the content of my composer.json file.

    "name": "root/chesla",
    "require": {
        "composer/installers": "^1.7",
        "drupal/core": "^8.8",
        "drupal/address": "^1.9",
        "drupal/addtoany": "^1.12",
        "drupal/admin_toolbar": "^2.0",
        "drupal/ajax_form_entity": "^1.0-alpha1",
        "drupal/backup_migrate": "^4.1",
        "drupal/allowed_formats": "^1.2",
        "drupal/block_class": "^1.3",
        "drupal/captcha": "^1.1",
        "drupal/context": "^4.0-beta2",
        "drupal/ctools": "^3.2",
        "drupal/devel": "^2.1",
        "drupal/diff": "^1.0",
        "drupal/entity": "^1.1",
        "drupal/exclude_node_title": "^1.1",
        "drupal/features": "^3.8",
        "drupal/field_group": "^3.0",
        "drupal/media_entity": "^1.8",
        "drupal/imce": "^2.2",
        "drupal/libraries": "^3.0-alpha1",
        "drupal/mailsystem": "^4.3",
        "drupal/image_widget_crop": "^2.3",
        "drupal/markup": "^1.0-beta1",
        "drupal/menu_block": "^1.6",
        "drupal/metatag": "^1.13",
        "drupal/mimemail": "^1.0-alpha2",
        "drupal/module_filter": "^3.1",
        "drupal/paragraphs": "^1.11",
        "drupal/pathauto": "^1.6",
        "drupal/recaptcha": "^2.5",
        "drupal/typed_data": "^1.0-alpha4",
        "drupal/rules": "^3.0.0-alpha5",
        "drupal/sharethis": "^2.0-beta3",
        "drupal/simplenews": "^1.0-beta1",
        "drupal/sitemap": "^1.5",
        "drupal/token": "^1.7",
        "drupal/views_bootstrap": "^4.2",
        "drupal/views_fieldsets": "^3.3",
        "drupal/yoast_seo": "^1.7",
        "drupal/migrate_upgrade": "^3",
        "drupal/migrate_plus": "^4",
        "drupal/migrate_tools": "^4.5",
        "drupal/bootstrap": "^3.21",
        "drupal/context_layout": "^1.0-beta2",
        "drupal/crop": "^2.1",
        "drupal/entityqueue": "^1.0",
        "drupal/views_slideshow": "^4.7",
        "drush/drush": "^10.3",
        "drupal/bootstrap_simple_carousel": "^1.43",
        "drupal/carousel_block": "^1.10",
        "drupal/slick": "^2.3",
        "drupal/webform": "^6.0",
        "drupal/core-composer-scaffold": "^8.9"
    "repositories": {
        "drupal": {
            "type": "composer",
            "url": "https://packages.drupal.org/8"

I just noticed that I have drush listed. I don't use it and don't know how to use it.

$ drush --version
Drush Launcher Version: 0.6.0
Drush Commandline Tool 10.3.6

I am trying to use composer here to update. I can install modules (did webforms the other day).

Thank you.

  • 1
    Delete the module folder, and run composer install to re-install the module. If you still see the same incorrect module version on the page, it probably means the web page you are looking at is for a different instance than the code you are using Composer on.
    – Jaypan
    Commented Jul 21, 2021 at 15:40
  • I would also check the module's .info.yml file, e.g. address.info.yml to see what it shows for a version.
    – sonfd
    Commented Jul 21, 2021 at 17:03
  • Bear in mind that Composer is only used to update the codebase. You will separately need to interact with Drupal in order for Drupal to become aware of the changes. In the simplest scenario, clearing the site's cache will make Drupal aware of the updated codebase. In some cases, you might also need to update the DB, via drush updb or by visiting /update.php on your site.
    – Beau
    Commented Jul 21, 2021 at 18:30
  • All good suggestions. I tried them but didn't work. [1.] @Jaypan I removed the module folder and ran composer install. It re-installed the modules but the Drupal report hasn't changed. [2.] @sonfd checked the module's .info.yml file and it shows the UPDATED version. [3.] @Beau Ran /update.php and drush updb after clearing the cache and both say there are no updates
    – Hometoy
    Commented Jul 21, 2021 at 19:36
  • Are you sure you are not working local, and looking at the remote site, or some variation of that? This is the only way that I know of where the displayed version is not the actual version. You can confirm the actual version by looking at address.info.yml
    – Jaypan
    Commented Jul 21, 2021 at 23:04

3 Answers 3


Running composer update isn't a recommended way to update.

Here you can find a, step by step, recommended way to update your codebase on local and on production.

After a codebase update running a database update is the key here. If you use drush run drush updb. If you don't use drush you can visit [YOUR DOMAIN]/update.php in any browser.

NOTE: if you visit your site [YOUR DOMAIN]/update.php you also might want to change settings.php

in settings.php set the default FALSE to TRUE in:

$settings['update_free_access'] = FALSE; // default

  • I found that the issue was I had a second /modules directory in my /sites/default/ directory with the outdated versions. I deleted the /sites/default/modules directory and then Drupal reflected the correct module versions.
    – Hometoy
    Commented Jul 27, 2021 at 12:35

Try this:

composer update drupal/address --with-all-dependencies


Delete the file composer.lock and Try this:

composer update

  • I found that the issue was I had a second /modules directory in my /sites/default/ directory with the outdated versions. I deleted the /sites/default/modules directory and then Drupal reflected the correct module versions. I'll keep the --with-all-dependencies flag in mind in the future.
    – Hometoy
    Commented Jul 27, 2021 at 12:36

Same problem here (composer updates not being reflected in the Drupal's Available Updates). The problem was as @Hometoy said, two directories. In my case, one was /modules and the other /modules/contrib. Deleting the module inside /modules and keeping the newer version in /modules/contrib did the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.