Update Drupal 8 Core with Composer as You Prepare for Drupal 9: Key Steps and Best Practices

"Begin preparing now! First of all, keep Drupal core and all contributed projects up to date" is Acquia's advice for getting ready for Drupal 9... that we all know already. And Composer is one of the best options for updating your Drupal 8 website. But: how precisely do you update Drupal 8 core with Composer?

What are the:

  • key steps to take
  • best practices to apply
  • main issues to prepare for
  • special considerations to keep in mind?

In this post, I'll do my best to answer some of your legitimate questions with respect to Composer and Composer as the most efficient update tool for Drupal 8:

  • "What exactly is Composer?" 
  • "Why use Composer when I can update Drupal 8 by just downloading it from Drupal.org...?
  • "Composer in Drupal 8.8.0: what does it mean exactly?"
  • "How do I update Drupal 8 core with Composer?"

1. What Is Composer? 

It's a dependency manager for PHP that will install/update for you all the libraries that your Drupal 8 setup depends on.

Is that concise, yet accurate enough for you?

Take it as a convenient way to streamline the whole process of updating your Drupal 8 core and modules.

From core dependencies (e.g. Simfony components) to various packages, it will manage (install/update) them all for you.


2. But Why Precisely Composer? Why Should I Use It Anyway?

"Why bother update Drupal 8 core with Composer when I can simply... download both core and modules from Drupal.org?"

A legitimate question indeed...

Now, let me point out to you just a few downsides to updating your Drupal 8 setup using the "download from Drupal.org" method:

  • you might discover, while updating your Drupal 8 core and modules, that some of those modules and packages are compatible with certain Drupal and PHP versions only; identifying and addressing those issues manually is anything but time-effective
  • some themes and modules require a third-party library to run the application; managing each of those additional libraries individually can get cumbersome on the long term
  • when you run your composer update on the CLI, some modules and packages run the risk of colliding with each other


3. From Composer in Drupal 8.8.0 to... Composer Support in Core  

Drupal 8.8.0 ships with full Composer support for building Drupal websites:

Update Drupal 8 Core with Composer: Prepare for Drupal 9

Source: Drupal.org

But how does this streamline your Drupal 8 updating process more precisely?

Which are the specific commands to use to update your Drupal 8 project?

  • composer update to update Drupal 8 core and your modules
  • composer update drupal/core-recommended –with-dependencies to update Drupal core only

For the whole list of Composer plugins and templates added to Drupal 8.8.0, explore the new/composer folder in Drupal core.


  • a new Composer template — drupal/recommended-project (replacing the "old" drupal-composer/drupal-project) — that generates a Drupal 8.8+ compliant project structure
  • to a plugin that automates the scaffolding of the Drupal core Composer package to its due place

... you'll find plenty of great "surprises" there.

And adding native Composer support to Drupal 8.8.0 is not just a step, but a huge... leap forward.

Towards the main goal that started the Composer Support in Core initiative in the first place:

To provide Drupal users with Composer support right out of the box.


4. How Do I Update Drupal 8 Core with Composer?

Now that we've clarified "the what" and "the why" of Composer update Drupal core, let's tackle the "how", as well:

How do you use Composer to update Drupal 8 core (and contributed modules)?

Now, here's the simplified version of all the step-by-step guides that you can find on the web:


4.1. Before You Begin...

... make sure you follow the "updating dependency" steps and that you name your package: "drupal/core"

Also, remember to specify a new minimum version for drupal/core. This way, you avoid the scenario where an accidental downgrade gets performed instead.

Note: keep in mind to update your database once you've downloaded the new package.


4.2. Install Composer on Your Machine

A more than... obvious step, so I won't insist upon it.

It's as simple as executing the installer in your command line...


4.3. Take a Backup of Your Database and Files

One of the essential best practices when you update Drupal 8 core with Composer.


Word of caution: drush archive-dump don't work with Drush 9 anymore, so you'll need to rely on your CLI tool for that; use the tar command.


4.4. Look for Drupal Core and Packages Available to Update

Go through the core release notes to identify the packages that you need to update.

Note: first, check whether a Drupal core update is, indeed, available: composer outdated "drupal/*"

Next, run "Composer outdated" in your CLI. It will provide you with the full list of packages that you'll need to update your Drupal 8 setup.

4.5. Update Drupal 8 Core with Composer

Now that you're certain that there is an update available:

  • enter the drush sset system.maintenance_mode 1 command to turn on the maintenance mode; use drush cr to clear the caches
  • enter Composer update Drupal/core –with-dependencies to update the Drupal core and its dependencies


4.6. Update Your Modules

Composer is, again, your reliable ally when it comes to keeping the modules running on your Drupal 8 setup up to date.

Just run the composer require “drupal/<modulename>:<version> command and it will download all the updated versions of your modules, along with their dependencies.

Note: keep in mind to specify your modules' names and versions when running this command.


4.7. Deactivate the Maintainance Mode and Test Your Updated Website

Enter the drush state:set system.maintenance_mode 0 command, then the drush cache:rebuild one to turn off the maintenance mode.

Next, step into the shoes of an anonymous user and "take it for a test drive".


5. Moving on to Drupal 9 with... Composer

As a final word to this post on why and how to update Drupal 8 core with Composer, I'll add just a few:

  • tips
  • pieces of advice
  • "words of cautions"

... for making your transition to Drupal 9 as smooth as possible:

  • remember that you'll need to upgrade from the drupal-composer/drupal-project before Drupal 9
  • scaffold files will no longer be in their original locations in D9
  • as you're preparing your website for Drupal 9, keep your Drupal 8 core, all your contributed modules, and third-party dependencies safely up to date

In this respect, set up a "Composer update Drupal core" routine. And stick to it...

The END!

Are you already using Composer to update your Drupal setup? What do you think about the Composer Initiative's progress so far? 

How are you getting your website Drupal 9-ready? Let me know in the comments down below:

Image by Peggy und Marco Lachmann-Anke from Pixabay