Contrib.social

Require Drupal 11.2.3 and add Composer as a runtime dependency

Open on Drupal.org →
Created on 13 July 2025, about 2 months ago

Problem/Motivation

Drupal core 11.2.3 landed a few improvements to Package Manager that make it automatically use a copy of Composer packaged locally with the project (i.e., with composer/composer as a dependency). We should absolutely take advantage of these improvements, as they make Package Manager quite a bit easier to get started with.

Proposed resolution

When it comes out, require Drupal 11.2.3 or later (^11.2.3) in the project template, along with composer/composer:^2.8. Then roll a new release of drupal/cms. This can go into a patch release of Drupal CMS 1.2.x.

The cPanel-ready project template should not have the Composer dependency, because that would put Composer's executable(-ish) files into the web root, and that is a security risk. We need a further change in core before we can do that.

✨ Feature request
Status

Postponed

Component

General

Created by

🇺🇸United States phenaproxima Massachusetts

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024