The composer.json diff for the Drupal 10 to 11 upgrade on this site is thirteen lines: a handful of version constraints bumped, doctrine/annotations added back, symfony/runtime allow-listed. The composer.lock diff for that same commit is 2,109 lines changed — 1,416 insertions, 693 deletions, one file.
Composer has a specific way of telling you a package is a bad long-term bet: when a dependency is marked abandoned on Packagist, the lock file itself records "abandoned": true against that package's entry, and every install or update that touches it prints a warning.
Somewhere in the middle of upgrading this site from Drupal 10 to 11, composer require drupal/core-recommended:^11 stopped and refused to install anything at all, not because of a version conflict this time, but because one of the packages it needed to pull in, symfony/runtime, ships a Composer plugin, and Composer plugins don't get to run just because they're in the de
Every guide to composer.lock tells you the same thing: commit it, and every environment that runs composer install against it gets identical dependency versions. That's true as far as it goes.
Upgrading this site to Drupal 11, the very first command I ran should have been the anticlimactic one: composer require drupal/core-recommended:^11. Instead it failed immediately, and the reason it gave was, technically, true and completely useless at the same time.
Here is the Dockerfile almost everyone writes first:
Most PHP developers know just enough about Composer autoloading to make it work. But when class resolution fails in a Drupal module, a package publishes duplicate class definitions, or a legacy library throws "class not found" mid-request, you need to understand what the autoloader is actually doing.
Most PHP developers know just enough about Composer autoloading to make it work. But when class resolution fails in a Drupal module, a package publishes duplicate class definitions, or a legacy library throws "class not found" mid-request, you need to understand what the autoloader is actually doing.
GitHub Actions is the dominant CI/CD platform for PHP projects, and for good reason: it is free for public repositories, tightly integrated with your code history, and the marketplace has ready-made actions for every part of a PHP pipeline.
When starting a new PHP project, Composer is the foundation of modern PHP development. It automates dependency management, handles autoloading, and ensures your codebase remains consistent across environments.