Resolving Composer dependency issues in Drupal 8.4.x update

The 8.4.x update to Drupal introduced a lot of headaches to the update process when managing your site dependencies with Composer. In this article I'll run through the issues I faced during this update, and what I ended up doing to resolve them and update to Drupal 8.4.4.

Part of Drupal 8’s effort to be more in line with the greater PHP community was the move to use Composer, PHP’s package manager, to manage PHP dependencies. The idea is that instead of having to commit all of the Drupal code to your version control system, you simply check in the code specific to your site (mostly the ‘sites’ directory), along with your composer.json and composer.lock files, which then declare the PHP dependencies (including all of your contrib modules and themes). Then you are simply able to run 'composer install' to install all dependencies at once.

I was recently updating a client’s website in Drupal 8, running version 8.3.7. I had used the Composer template for Drupal projects recipe to build the site and manage dependencies. The first few rounds of Drupal core or module updates went swimmingly with 'composer update <package name>'. Not this time. I was getting lots of errors like this:

Your requirements could not be resolved to an installable set of packages.

This line would then be followed by a long list of package dependencies that clashed with one another. I spent some time on Drupal.org reserching the issue, and found this issue thread, which gives some suggestions for switching up your Composer dependencies to get around this mess. After a few hours I was able to get it working on my local dev environment (a PHP 7 based Vagrant  VM).

To throw an extra wrench into the spokes, I remembered that the production web server was running PHP 5.6. The server could not be immediately updated to PHP 7 due to the fact that other sites are also running on the server that would require compatibility testing before upgrading PHP. This meant that I could not have any PHP dependencies on the site that required PHP 7 or higher.

So after talking with some excellent folks on the Drupal Support group on Facebook, and consulting the Composer documentation, I found a way to declare a constraint for the PHP version, adding a platform setting to the config section of composer.json:

"config": {
    "platform": { 
        "php": "5.6"
    }
}

That solved the first problem of ensuring only packages compatible with PHP 5.6 were used. Next was making sure that Drupal and its dependencies were using the verified package versions from drupal.org's automated tests for core. Luckily there’s a package for this: webflo/drupal-core-strict.

To use the drupal-core-strict package, its version constraint in the package.json file must match the version of Drupal core you want. The latest version at the time was 8.4.4. This would translate into the following line in the composer.json require section:

"webflo/drupal-core-strict": "8.4.4"

There are also specific version constraints that were neded to get Composer to install the updates properly:

"composer/installers": "^1.4",
"webflo/drupal-finder": "^1.0",
"drush/drush": "^9.0",
"drupal/console": "^1.0"

To resolve the dependency issues for the 8.4.4 update, I entered the following commands (in this order) from the root of my project:

composer update webflo/drupal-finder --with-dependencies
composer require composer/installers:"^1.4"

And then finally, the actual Drupal update via:

composer require webflo/drupal-core-strict:8.4.4 drupal/core:8.4.4 drupal/console:^1.0 drush/drush --update-with-dependencies
drush updb
drush cr

I hope this helps everyone out there trying to perform a similar update!