Starting with Drupal V8 (aka D8), it is recommended that composer be used for all updates. This is an easier way to keep track of all dependicies and update paths. From my experience it is about the same level of difficulty as using drush was for Drupal V7 when there are no significant dependicies.

I recently needed to update a rather complex D8 site. The hosting company (probably the host control panel software) updated composer to version 2. It’s always good to be running on the most recent stable version. … However, in this case there were several plug-ins to Composer that were tied to the previous V1 installation and would not run in V2.

Composer was generating a number of errors when I tried the simple update of a few modules. Drupal could not be updated and (for once) it wasn’t a Drupal problem. But it was because the configuration file (composer.json) was for the Drupal installation. That file was using a number of older plug-ins. These needed to be upgraded so the upgrade operation would work.

That seems to be a lot of work, why should you upgrade composer. Well… there is the philosophy of always using the latest stable version of libraries and tools. That version should have fixed all known bugs. In composer’s case there is also the issue of memory management. Drupal seems to always take up HUGE amounts of memory – usually so much so that your need to tell it to use unlimited memory. This has been fixed (as far as I can tell) in composer 2. For other reasons see the excellent article at … [link]

The solution was to install the latest V1 of composer, do the plug-in updates, then do the Drupal updates using composer V2. Sounds simple. Download composer V1. Um, not the easiest thing to do; but I can download and install the latest (V2), then downgrade back to V1. Pick a directoryyou can write to and whose path Is not too long (e.g., /path/to), then execute the following commands (assuming a U*nx system).

pushd /path/to
wget --output-document=composer-setup.php \
         https://getcomposer.org/installer
php composer-setup.php
rm -f composer-setup.php
php ./composer.phar self-update --1
popd

The ability of composer to downgrade composer was noted by Leopold Jacquot.

Assuming you installed composer at /path/to/composer, you would then execute the following commands to update Drupal installed in the base directory of /drupal/path with the website at /drupal/path/web.

pushd /drupal/path
php -d memory_limit=-1 /path/to/composer.phar \
         config minimum-stability dev
php -d memory_limit=-1 /path/to/composer.phar \
         config prefer-stable true
php -d memory_limit=-1 /path/to/composer.phar \
         update --dry-run

php -d memory_limit=-1 /path/to/composer.phar \
         update --with-dependencies
pushd web
drush updatedb
popd
popd

You should review the output after --dry-run  to make sure only things you wish to update are included. Update restrictions would happen right after. Only do the ‘update --with-dependencies’ as the final update step. You will still need to use drush to update the database.

Any Drupal updates after composer.json is updated can use the latest (V2) version of composer.

Also see the article Updating Drupl core via Composer for additional details and information on updates.