Drupal adheres to the best-practice of never modifying core.

Drupal 8 has a composer.json file built into core, if you need to add a third-party library, should you modify composer.json, or is there a better way to do this?

  • Can we re-open this discussion given that it's been two years since it was last discussed? I've read that in Drupal 8 RC1, one can now manage modules directly via composer require in the Drupal docroot. That's all well and good, but what if I need to do composer require drupal/drupal-extension which pulls in Behat, and subsequently modifies many things in D8 core's vendor directory? This is particularly a tricky question in Pantheon where apparently the repo root must be the Drupal docroot.
    – kostajh
    Commented Nov 1, 2015 at 17:56

3 Answers 3


It is possible to consume Drupal 8 into your own composer.json file:

    "name": "davidbarratt/mydrupalproject",
    "require": {
        "drupal/drupal": "8.*"
        "composer/installers": "1.*"
    "repositories": [
            "type": "package",
            "package": {
                "name": "drupal/drupal",
                "type": "drupal-core",
                "version": "8.0.0-dev",
                "source": {
                    "url": "http://git.drupal.org/project/drupal.git",
                    "type": "git",
                    "reference": "8.x"
    "minimum-stability": "dev"

There's a pull request to composer/installerswill allow installation of drupal-core project types: http://github.com/composer/installers/pull/38

Would love your input on the above pull request, as well as this other one in the queue that allows installation of modules/themes/profiles.

Another solution that currently works is the Composer Manager module, which facilitates composer.json use for modules. It's currently available for Drupal 7, and will be available for Drupal 8 once the Drupal 8 alpha releases are close.

Thanks a lot, Rob


There is also the Composer module that is a Drush wrapper to Composer. Your module can then supply its own composer file which Drush will use to download additional dependencies for your module -- or site if you use say at least 1 "custom" module for your drupal site.

I also recommend watching this Drupal8 / Composer seminar from DrupalCon Munich 2012: http://munich2012.drupal.org/content/drupal-has-dependencies-lets-manage-them

  • Drush Composer is just a wrapper around Composer. If you use it to modify Drupal's Composer-based requirements, it will modify Drupal's root composer.json file. Also, the video for Munich 2012 is no longer available.
    – paul-m
    Commented Nov 18, 2014 at 19:15


It is acceptable to use Composer the way it's supposed to be used. :-)


This package exists to help you manage your Composer-based Drupal project: https://github.com/drupal-composer/drupal-project

  • Do you have a citation? Commented Nov 17, 2014 at 20:30
  • I have this: composer create-project drupal/drupal drupal_root ~8@dev --keep-vcs cd drupal_root composer require vendor/package ~1 ...decide you don't need that package... git checkout -- composer.json composer update And I'd like to keep that.
    – paul-m
    Commented Nov 18, 2014 at 19:18
  • That still modifies the root composer.json file. You'd still have to merge your changes with Drupal's changes. Or worse, if someone doesn't update their composer file as their told, you could encounter major errors or critical security holes. How do you get around this? Commented Nov 19, 2014 at 13:41
  • You don't. You have to do those things. There is no automatic composer stuff for Drupal 8 at the moment, beyond any script you might make to do it.
    – paul-m
    Commented Nov 20, 2014 at 17:50
  • If you have to merge changes with Drupal, isn't that exactly why you don't modify core? Commented Nov 22, 2014 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.