Since Composer is the widely accepted standard for building websites running the current Drupal version, Remote Administration (RA) uses only Composer builds and updates to ensure that dependencies are included in the current Drupal version or contributed module update.

RA will continue to use Drush to detect insecure modules.

Requirements

Installations of the current Drupal version must be built with a fully functional composer.json file including all code necessary to run your codebase, and containing no package conflicts.

Minimum requirements for a composer.json file for RA

The following outlines the minimum requirements for a composer.json file to be compatible with Remote Administration:

• The composer.json file for your website must be located above the docroot directory in your repository. Do not move the composer.json or vendor/ directory packaged with Drupal core, located inside of the docroot directory. The following example shows a repository with the composer.json file and vendor/ directory in the correct locations relative to your repository’s root:

  

• The vendor/ directory must be located in the repository’s root above the docroot directory. This directory must be managed through version control, and the proper autoloading must be set up to redirect Drupal to the new vendor location. For more information, see Drupal scaffold.

• A Drupal composer.json file must specify at least the following basic information:

  copy

  "repositories": {
  "require": {
  "require-dev": {
  "config": {
  "conflict": {
  "extra": {
  "installer-paths": {

• The require section of the composer.json file needs to list Drupal core and all contributed modules, packages required to run your Drupal website, and the minimum php version for your site requirement.

  copy

  "require": {
      "php": "7.1"
  }

• In the config section, you must specify your platform php version:

  copy

  "config": {
      "platform": {
          "php": "7.4"
      }
  }

How RA automation works with Composer

The Remote Administration update process performs a series of update commands against your website on the RA environment, determines any needed updates, applies the changes, and notifies you, as described in the following steps:

1. The latest production code and a copy of your production database are copied to the RA environment.
2. Your codebase is examined for a valid composer.json file above the docroot directory.
   • If a valid composer.json is located, RA will proceed with the update process.
   • If no composer.json file is located, RA will revert to applying updates using Drush. For the current Drupal version, refer to the important note about the current Drupal version and using Drush for updates.
3. The code is scanned for the following types of updates with the drush pm-updatestatus command:
   • Security updates for contributed modules
   • Bugfix updates for specified contributed modules
   • Bugfix and security updates for Acquia-managed modules
4. The most recent version of Composer is temporarily installed on the RA environment.
5. Composer updates are determined and applied with the composer update --dry-run command in your RA environment to ensure your composer.json file has no errors preventing updates from completing. No changes are made to your codebase. If conflicts requiring resolution before applying updates are detected in your composer.json file, you will receive an Acquia Support ticket notifying you of these conflicts so you can resolve them.
6. Composer performs the command to update your package to the highest available version allowed by the version constraints in your file.

RA file templates

The Acquia RA Composer GitHub repository has an example composer.json file you can use as a starting point for creating your website’s composer.json. The repository has the following files:

• composer.json: An example file for Composer
• readme.md: How to use the composer.json
• annotated.composer.json: An annotated example file with explanations of the configuration sections

To use the example Composer file, you can download the file and copy its contents into your own composer.json file. Alternately, clone the repository and then copy the file to your website’s repository.