Notes on how to update a Drupal 8 website with Drush and Composer

The process of updating a Drupal 8 website changed dramatically back in March-April, 2018, so I deleted the older content on this page and replaced it with the content below.

As of April, 2018 you now need to use Composer along with Drush to update your website. Here are my very brief notes on how to do this:

# note to self: use your `drush8` alias rather than `drush`

- Backup your website files
- Backup your Drupal/website configuration files
- Backup your database

- Clear the cache
  drush cr

- Put your site in maintenance mode
  drush sset system.maintenance_mode 1

- Do the actual update
  composer update drupal/core --with-dependencies
  drush updatedb

- Take the site out of maintenance mode
  drush sset system.maintenance_mode 0

- Clear the cache again
  drush cr

As one note about this, the process of updating from Drupal 8.5.1 to Drupal 8.5.2 failed with this error:

OUTPUT: Package "drupal/core" listed for update is not installed. Ignoring.

I found the solution to the problem at this SO page. Suffice it to say, if you plan to keep working with Drupal 8, you’ll want to learn about how Composer works.

Installing a Drupal security update with Composer

Today (August 1, 2018) I had a problem trying to get Composer to update my website from Drupal 8.5.5 to Drupal 8.5.6, where 8.5.6 is a security update. This command did not work:

composer update drupal/core --with-dependencies

But I found that this command did work:

composer update drupal/core --with-all-dependencies

Update: I had that same problem on March 20, 2019, with the Drupal 8.6.13 security update, and once again the --with-all-dependencies flag solved the Drupal core update problem.

Here’s some information on the differences between --with-dependencies versus --with-all-dependencies, from the Composer documentation:

--with-dependencies: Add also dependencies of whitelisted packages to the whitelist,
                     except those that are root requirements.
--with-all-dependencies: Add also all dependencies of whitelisted packages to the whitelist,
                     including those that are root requirements.

This Debug Academy page helped me find that solution. If you need to update Drupal core I hope that information helps.

Drupal/Composer/Drush FAQs

I thought I’d put some Drupal/Composer/Drush FAQs here so I don’t have to keep searching for them.

Q: From this page: What does it mean when `composer outdated` shows components that need updating, but the `composer update` command indicates that nothing needs to be updated?

A: Nothing. In composer.json you can limit which versions you accept for a dependency. Drupal core specifies Symfony 2.8.*, so even though there are newer versions of Symfony, Composer keeps you on 2.8 because that's what core wants.

Q: How do I make a database backup with Drush?

A: Run drush cr, then this:
drush sql-dump > 2018-10-21.sql

Q: What is Composer, and how does it work with Drush 9?

A: Composer is a dependency manager for PHP. Drupal core uses Composer to manage core dependencies like Symfony components and Guzzle. Drush 9 no longer supports updating Drupal and leaves the work to Composer.

Q: What is the syntax for adding entries to the composer.json file?

A: You can add entries to the composer.json file manually, but I’ve found it easiest to add entries to that file using commands like these at the command line:

composer require 'drupal/token:^1.5'
composer require 'drupal/metatag:^1.7'

Lately I’ve been able to find these commands on Drupal module release pages, like this Token release page.

How to update Drupal modules with Composer, or manually

In theory, you can update Drupal 8 modules with Composer using either of these two commands:

composer update drupal/metatag --with-dependencies
composer require 'drupal/metatag:^1.8'

In practice, those commands didn’t work today (Feb. 21, 2019), so I just wrote a little post about how to update Drupal 8 modules manually from the command line.

Notes from January, 2020

Here are a couple of links from January, 2020, related to updating from Drupal 8.6 to 8.8.1:

And a note on how to update Drush with Composer:

composer update drush/drush

Related links