security-updates

Security Updates for Drupal with Composer

Use when:

• Running a security audit on a Drupal project
• Fixing packages flagged by composer audit
• Applying a specific security advisory
• Verifying no known vulnerabilities remain

Before You Start — Create a Branch

This step is mandatory. Do not run any composer commands until a new branch is created and confirmed. Never update packages directly on main or master.

Check the current branch first:

git branch --show-current

If the user is on main, master, or any protected branch, stop and ask: "What would you like to name the new branch for these security fixes?"

Suggest a default if they are unsure (e.g., security/drupal-updates-YYYY-MM-DD).

git checkout -b <branch-name>

Confirm the new branch is active before proceeding:

git branch --show-current

Only continue to the next step once the output confirms a non-protected branch.

Audit for Vulnerabilities

composer audit

Output lists packages with known advisories, CVE IDs, and links to the advisory.

JSON output (for scripting)

composer audit --format=json

Audit without dev dependencies

composer audit --no-dev

Fix a Specific Vulnerable Package

composer update drupal/package --with-all-dependencies

Use --with-all-dependencies to allow transitive dependency version changes required by the update.

Example — fix a known advisory in drupal/core

composer update drupal/core-recommended drupal/core-composer-scaffold --with-all-dependencies

Fix All Packages with Advisories

Update only packages flagged by the audit, staying within the version constraints in composer.json:

composer update --with-all-dependencies $(composer audit --format=json 2>/dev/null \
  | python3 -c "import sys,json; data=json.load(sys.stdin); print(' '.join(set(a['packageName'] for a in data.get('advisories', {}).values() if isinstance(a, dict)) or [v[0]['packageName'] for v in data.get('advisories', {}).values()]))" 2>/dev/null)