Using Composer with Drupal

Context

• Drupal 8.x
• Drupal 9.x
• Drupal 10.x

Background

Composer is a dependency manager for PHP. Drupal core uses Composer to manage core dependencies like Symfony components and Guzzle.

There are many benefits to using Composer. In short, it allows us to systematically manage a sprawling list of dependencies (and their subsidiary dependencies). It assists with locating, downloading, validating, and loading said packages, all while ensuring that exactly the right versions for each package are used. It can be a pain, but it's far better than using either nothing or developing a home-brewed solution.

Composer in Drupal core

Drupal's composer-built dependencies are not committed (via git) to Drupal core's repository. This is why you will not find a "vendor" directory in the core repository. Instead, composer.json and composer.lock are committed to Drupal core. These files act as a manifest for building dependencies.

Drupal.org builds Drupal core's composer-defined dependencies and packages them (along with Drupal itself) into the .zip and .tar.gz archives that are available for download on Drupal.org. So, if you've downloaded Drupal as a .tar.gz or .zip file from Drupal.org, or if you've used Drush to download Drupal (deprecated since Drush 9), then the Composer dependencies for Drupal core have already been built and provided to you.

If you'd like to manage additional dependencies via Composer (beyond the dependencies already required by Drupal core) then continue reading.

Using Composer to manage Drupal dependencies

There are a few scenarios in which you might use Composer on a Drupal project.

Manage dependencies of an entire Drupal site with Composer

As a Drupal site architect, I'd like to manage dependencies for an entire Drupal site with Composer.

To 

• Download/install and update Drupal core with Composer 
• Install and update contributed modules, themes and their third party dependencies with Composer.

read Using Composer to manage Drupal site dependencies (applies both to 8.x, 9x, and 10.x)

Note: Using composer_manager is deprecated since Drupal 8.1.

Manage dependencies for a custom module or theme with Composer

As a Drupal developer, I'd like to manage contributed dependencies for a custom module or custom theme with Composer.

• If you are developing a custom module or custom theme that will not be contributed on Drupal.org, you can manage dependencies for your custom project using Composer.
• Note: Drupal's packaging system does not support dependency management for profiles, distributions, or Drush extensions. You cannot manage dependencies for these project types with Composer. For background, see #2715441: Support for distributions.

Manage dependencies for a contributed module or theme with Composer

As a maintainer of a contributed Drupal project, I'd like to manage third party dependencies of my module or theme with Composer.

• If a contributed project has a dependency to third party libraries hosted on Packagist, they can define the dependencies in composer.json located in the module / theme directory.
• Most contrib developers do not need to do this as long as their dependencies to other Drupal modules / themes are expressed in their info.yml files. 
• Managing dependencies for a contributed project
• Add a composer.json file 

See also

• If you were using Drush make before, read a comparison.
• The Drupal-project readme file.
• Composer Generate: a Drush extension for generating a composer.json file from an existing project.