Security Updates for Drupal with Composer

• Running a security audit on a Drupal project
• Fixing packages flagged by

  composer audit

• Applying a specific security advisory
• Verifying no known vulnerabilities remain

Before You Start — Create a Branch

This step is mandatory. Do not run any composer commands until a new branch is created and confirmed. Never update packages directly on

main

or

master

.

git branch --show-current

main

master

security/drupal-updates-YYYY-MM-DD

git checkout -b <branch-name>

git branch --show-current

Audit for Vulnerabilities

composer audit

JSON output (for scripting)

composer audit --format=json

Audit without dev dependencies

composer audit --no-dev

Fix a Specific Vulnerable Package

composer update drupal/package --with-all-dependencies

--with-all-dependencies

Example — fix a known advisory in

drupal/core

composer update drupal/core-recommended drupal/core-composer-scaffold --with-all-dependencies

Fix All Packages with Advisories

composer.json

composer update --with-all-dependencies $(composer audit --format=json 2>/dev/null \
  | python3 -c "import sys,json; data=json.load(sys.stdin); print(' '.join(set(a['packageName'] for a in data.get('advisories', {}).values() if isinstance(a, dict)) or [v[0]['packageName'] for v in data.get('advisories', {}).values()]))" 2>/dev/null)

# List vulnerable packages from audit output, then update each
composer update drupal/package1 drupal/package2 --with-all-dependencies

Verify No Vulnerabilities Remain

composer audit

No security vulnerability advisories found.

After the audit is clean, always ask the user these questions in order:

1. "Do you want to commit these changes?"

• If yes:
  bash

  git add composer.json composer.lock
  git commit -m "Apply Drupal security updates"

• If no → remind the user that

  composer.json

  and

  composer.lock

  are uncommitted before proceeding.

2. "Do you want to deploy these changes to an Acquia environment?"

• If yes → follow the Drupal Update and Deploy playbook to push code, switch the environment, and optionally trigger a pipeline build.
• If no → done.

Troubleshooting

"Your requirements could not be resolved"

# Check what requires the package
composer why drupal/package

# Check what prevents the update
composer why-not drupal/package 2.x

# Relax the constraint in composer.json if safe, then retry
composer update drupal/package --with-all-dependencies

Advisory persists after update

composer audit --update-cache
composer audit

Package cannot be updated without breaking other packages

# Check the full dependency tree
composer depends drupal/conflicting-package

composer.json

Best Practices

1. Run

   composer audit

   before every deploy — catch new advisories early.
2. Use

   --with-all-dependencies

   — security fixes often require transitive updates.
3. Review

   composer.lock

   diff — confirm only expected packages changed.
4. Check the advisory link — understand what the vulnerability is before updating.