Understanding Drupal's composer.json file line by line

Name

{
    "name": "drupal/legacy-project",

name: denotes the name of the package.

Description

    "description": "Project template for Drupal 9 projects with composer following drupal/drupal layout",

description: denotes the short description about the package.

Type

    "type": "project",

type: denotes the type of a package, by default the type of a composer package is library. Here Drupal is of type project it means that drupal is full-fledged application rather than just a library which could be used by other projects.

License

    "license": "GPL-2.0-or-later",

license: denotes the type of license this project uses in this case GNU's General Public License.

Homepage

    "homepage": "https://www.drupal.org/project/drupal",

homepage: denotes the url of the package's website.

    "support": {
        "docs": "https://www.drupal.org/docs/user_guide/en/index.html",
        "chat": "https://www.drupal.org/node/314178"
        }

support: contains list of various resources to get support about the project.

• docs: contains link of official documentation.
• chat: contains link for the chat channel.

Repositories

    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        }
    ]

repositories contains list of custom repositories to use, by default composer uses packagist repository to fetch packages. Here we are telling composer to fetch packages from https://packages.drupal.org/8.

Require

    "require": {
        "composer/installers": "^1.9",
        "drupal/core-composer-scaffold": "^9",
        "drupal/core-project-message": "^9",
        "drupal/core-recommended": "^9",
        "drupal/core-vendor-hardening": "^9"
    }

require contains list of packages required by this package. The current package could install only after all its requirements are installed.

Conflict

    "conflict": {
        "drupal/drupal": "*"
    },

conflict contains list of packages which conflict with this package for this version, this package will not get installed if any conflicting packages exists.

Minimum Stability

    "minimum-stability": "dev"

Minimum stability is used to filter packages based on their stability i.e stable, dev etc, the by default value of minimum-stability is stable. This means when you are trying to install a package via composer and the package is under development and there is no stable release yet, the composer will not install that package. Hence if you expect to work with package under development you should specify "minimum-stability as dev.

Prefer Stable

    "prefer-stable": true

If prefer-stable is set to true composer will perfer to install stable package version over unstable package versions.

Config

    "config": {
        "sort-packages": true
    }

Config is only supported with projects. config defines list of configurations for the project.

• if sort-packages is set to true the require command will keep the packages sorted by name inside composer.json whenever it adds a new package.

Extra

    "extra": {
        .
        .
        .

extra contains any extra data which can be used by scripts. To access the data from script you can use:

$extra = $event->getComposer()->getPackage()->getExtra();

Let's try to understand each section in extra

drupal-scaffold

        "drupal-scaffold": {
            "locations": {
                "web-root": "./"
            }
        }

Here the drupal-scaffold configuration for composer-scaffold plugin

The location defines location of the web-root in this case it is ./.

installer-paths

There are various types of packages which can be installed by composer in drupal, for e.g core, libraries, modules, themes etc.

        "installer-paths": {
            "core": [
                "type:drupal-core"
            ],
            "libraries/{$name}": [
                "type:drupal-library"
            ]
            .
            .
            .
        }

The installer-paths specifies where a package should be places according to its type. For e.g a drupal-core package should be placed inside the core directory, and a drupal-library package should be placed inside a directory with its name in libraries directory and so on.

drupal-core-project-message

This section is used for The Drupal Project Message Plugin. The project message plugin is used to display messages after composer finishes installation, you can get the full documentation here.

        "drupal-core-project-message": {
            "include-keys": [
                "homepage",
                "support"
            ],
            "post-create-project-cmd-message": [
                "<bg=blue;fg=white>                                                         </>",
                "<bg=blue;fg=white>  Congratulations, you’ve installed the Drupal codebase  </>",
                .
                .
                "<bg=yellow;fg=black>Next steps</>:",
                "  * Install the site: https://www.drupal.org/docs/8/install",
                .
                .
            ]
        }
    }
}

The include-keys is used to tell plugin to output the structured support information from the composer.json file. Currently the plugin supports name, description, homepage and support keys only.

The post-create-project-cmd-message contains the formatted message to display on the command line after the project is successfully created/installed.

And that's all! We understood what each section represents in drupal's default composer file.

References

Official composer documentation
Anatomy of a Composer Project
Using Drupal's Composer Scaffold
Using Drupal's Project Message Composer Plugin