Composer With Drupal 8

Steps to install the d8 site with composer:

1 - composer create-project drupal/recommended-project drupal8-pattern --no-interaction

2 - Add the permission /sites/default/files -- 777

and then visit the project from the browser and install,

Composer.json :

To start using Composer in your project, all you need is a composer.json file. This file describes the dependencies of your project and may contain other metadata as well.

Installing dependencies :

php composer.phar install

When you run this command, one of two things may happen: with composer.lock or without composer.lock

Installing without composer.lock

If you have never run the command before and there is also no composer.lock file present, Composer simply resolves all dependencies listed in your composer.json file and downloads the latest version of their files into the vendor directory in your project. (The vendor directory is the conventional location for all third-party code in a project).

Tip: If you are using git for your project, you probably want to add vendor in your .gitignore. You really don't want to add all of that third-party code to your versioned repository.

When Composer has finished installing, it writes all of the packages and the exact versions of them that it downloaded to the composer.lock file, locking the project to those specific versions. You should commit the composer.lock file to your project repo so that all people working on the project are locked to the same versions of dependencies (more below).

Installing with composer.lock

This brings us to the second scenario. If there is already a composer.lock file as well as a composer.json file when you run composer install, it means either you ran the install command before, or someone else on the project ran the install command and committed the composer.lock file to the project (which is good).

Either way, running install when a composer.lock file is present resolves and installs all dependencies that you listed in composer.json, but Composer uses the exact versions listed in composer.lock to ensure that the package versions are consistent for everyone working on your project. As a result you will have all dependencies requested by your composer.json file, but they may not all be at the very latest available versions (some of the dependencies listed in the composer.lock file may have released newer versions since the file was created). This is by design, it ensures that your project does not break because of unexpected changes in dependencies.

Commit your composer.lock file to version control#

Committing this file to VC is important because it will cause anyone who sets up the project to use the exact same versions of the dependencies that you are using. Your CI server, production machines, other developers in your team, everything and everyone runs on the same dependencies, which mitigates the potential for bugs affecting only some parts of the deployments. Even if you develop alone, in six months when reinstalling the project you can feel confident the dependencies installed are still working even if your dependencies released many new versions since then. (See note below about using the update command.)

Updating dependencies to their latest versions#

As mentioned above, the composer.lock file prevents you from automatically getting the latest versions of your dependencies. To update to the latest versions, use the update command. This will fetch the latest matching versions (according to your composer.json file) and update the lock file with the new versions. (This is equivalent to deleting the composer.lock file and running install again.)

php composer.phar update

If you only want to install or update one dependency, you can whitelist them:

php composer.phar update monolog/monolog [...]

Packagist#

Packagist is the main Composer repository. A Composer repository is basically a package source: a place where you can get packages from. Packagist aims to be the central repository that everybody uses. This means that you can automatically require any package that is available there, without further specifying where Composer should look for the package.

If you go to the Packagist website (packagist.org), you can browse and search for packages.

Ref : https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file