Dependency Updates for Drupal with Composer

• Checking which packages are outdated
• Updating Drupal core to a newer minor or patch release
• Updating contrib modules or libraries
• Resolving composer version conflicts after an update

Before You Start — Create a Branch

This step is mandatory. Do not run any composer commands until a new branch is created and confirmed. Never update packages directly on

main

or

master

.

git branch --show-current

main

master

deps/drupal-updates-YYYY-MM-DD

git checkout -b <branch-name>

git branch --show-current

Check for Outdated Packages

composer outdated

Check only direct dependencies

composer outdated --direct

Check a specific package

composer outdated drupal/core-recommended

Update a Specific Package

composer update drupal/package --with-all-dependencies

Update multiple packages at once

composer update drupal/package1 drupal/package2 --with-all-dependencies

Update Drupal Core (Minor or Patch)

composer update drupal/core-recommended drupal/core-composer-scaffold drupal/core-project-message --with-all-dependencies

Note: Minor upgrades (e.g., 10.2 → 10.3) may require relaxing the version constraint in

composer.json

first:

json

"drupal/core-recommended": "^10.3"

Then run the update command above.

Verify the installed version

composer show drupal/core | grep versions

Update All Packages

composer.json

composer update

This updates

composer.lock

but will not change version constraints in

composer.json

. Packages pinned to an older major will not cross that boundary.

Update All Drupal Contrib Modules

composer update "drupal/*" --with-all-dependencies

Resolving Conflicts

"Your requirements could not be resolved"

# What requires the package you're trying to update?
composer why drupal/package

# What prevents the target version?
composer why-not drupal/package 2.x

composer.json

Conflict between two contrib modules

# Check full dependency chain
composer depends drupal/module-a
composer depends drupal/module-b

composer update drupal/module-a drupal/module-b --with-all-dependencies

Revert a bad update

composer update

git checkout composer.lock
composer install

Verify the Update

# Confirm installed versions
composer show drupal/core-recommended
composer show --outdated

composer audit

composer audit

After verification, always ask the user these questions in order:

1. "Do you want to commit these changes?"

• If yes:
  bash

  git add composer.json composer.lock
  git commit -m "Update Drupal dependencies"

• If no → remind the user that

  composer.json

  and

  composer.lock

  are uncommitted before proceeding.

2. "Do you want to deploy these changes to an Acquia environment?"

• If yes → follow the Drupal Update and Deploy playbook to push code, switch the environment, and optionally trigger a pipeline build.
• If no → done.

Troubleshooting

composer.json

composer install

composer why-not package version

git diff composer.lock

COMPOSER_MEMORY_LIMIT=-1 composer update

Related

• Security Updates — Fix specific vulnerability advisories