Composer.json for Drupal 8.x project - Template. See www.drupal.org/docs/develop/using-composer/using-composer-to-install-drupal-and-manage-dependencies

composer.json

{
    "name": "tplcom/project",
    "type": "project",
    "description": "Project based on drupal/recommended-project, See manual at drupal.org/node/2718229",
    "homepage": "https://www.drupal.org/project/drupal",
    "license": "GPL-2.0-or-later",
        "require": {
        "php": ">=7.4",
        "ext-curl": "*",
        "ext-json": "*",
        "ext-mbstring": "*",
        "composer-plugin-api": "^2",
        "composer/installers": "^1.9",
        "cweagans/composer-patches": "^1.7",
        "drupal/admin_toolbar": "^3.0",
        "drupal/backup_migrate": "^5.0",
        "drupal/core-composer-scaffold": "^9.2",
        "drupal/core-project-message": "^9.2",
        "drupal/core-recommended": "^9.2",
        "drupal/environment_indicator": "^4.0",
        "drush/drush": "^10.2",
        "oomphinc/composer-installers-extender": "^2.0"
    },
    "require-dev": {
        "consolidation/robo": "^1.0.0",
        "dealerdirect/phpcodesniffer-composer-installer": "^0.7.0",
        "drupal/coder": "^8.3.1",
        "drupal/devel": "^4.1",
        "kint-php/kint": "^3.3",
        "mglaman/phpstan-drupal": "^0.12.7",
        "phpstan/phpstan": "^0.12.66",
        "phpunit/phpunit": "^8",
        "symfony/phpunit-bridge": "^5.0",
        "weitzman/drupal-test-traits": "^1.3"
    },
    "conflict": {
        "drupal/drupal": "*"
    },
    "config": {
        "preferred-install": "dist",
        "sort-packages": true,
        "optimize-autoloader": true
    },
    "extra": {
        "composer-exit-on-patch-failure": true,
        "drupal-scaffold": {
            "locations": {
                "web-root": "web/"
            },
	        "file-mapping": {
		        "[web-root]/sites/default/default.services.yml": false,
		        "[web-root]/sites/default/default.settings.php": false
	        }
        },
        "installer-paths": {
            "web/core": [
                "type:drupal-core"
            ],
            "web/libraries/{$name}": [
                "type:drupal-library",
                "type:npm-asset",
                "type:bower-asset"
            ],
            "web/modules/contrib/{$name}": [
                "type:drupal-module"
            ],
            "web/profiles/contrib/{$name}": [
                "type:drupal-profile"
            ],
            "web/themes/contrib/{$name}": [
                "type:drupal-theme"
            ],
            "drush/Commands/contrib/{$name}": [
                "type:drupal-drush"
            ],
            "web/modules/custom/{$name}": [
                "type:drupal-custom-module"
            ],
            "web/themes/custom/{$name}": [
                "type:drupal-custom-theme"
            ]
        },
        "installer-types": [
            "bower-asset", 
            "npm-asset"
        ],
        "patches": {}
    },
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        },
        {
            "type": "composer",
            "url": "https://asset-packagist.org"
        }
    ],
    "minimum-stability": "dev",
    "prefer-stable": true,
    "scripts": {
        "post-install-cmd": [
            "rm -f web/INSTALL.txt web/README.txt web/LICENSE.txt",
            "rm -f web/.gitignore web/example.gitignore",
            "find . -mindepth 2 -type d -name .git | xargs rm -rf"
        ]
    },
    "support": {
        "chat": "https://www.drupal.org/node/314178",
        "docs": "https://www.drupal.org/docs/user_guide/en/index.html"
    }
}

Composer_packages.md

Drupal core composer packages

• https://github.com/drupal/core-recommended
• https://github.com/drupal/core-composer-scaffold
• https://github.com/drupal/core-project-message

Development related composer packages

composer global require maglnet/composer-require-checker
composer global require insolita/unused-scanner
composer global require --dev brainmaestro/composer-git-hooks
composer global require --dev localheinz/composer-normalize
composer global require veewee/composer-run-parallel

• Need to add CKEditor plugins pattern. See https://www.drupal.org/docs/8/core/modules/ckeditor/managing-ckeditor-plugins-using-composer.

Investigate using:

• https://github.com/szeidler/composer-patches-cli to add/remove patches from cli
• https://github.com/BrainMaestro/composer-git-hooks to add githooks from package.json
• https://github.com/drupal-composer/drupal-paranoia to move all PHP files out of web root.
• https://github.com/Letudiant/composer-shared-package-plugin
• https://github.com/symfony/webpack-encore
• https://laravel-mix.com
• https://github.com/drupal/core-project-message (keep notes about issues related to the project)
• https://gitlab.com/davereid/drush-patch (apply patches from drush)
• https://github.com/JBZoo/Composer-Graph (visualize composer dependencies)
• https://github.com/Roave/SecurityAdvisories (Security reports)
• https://github.com/drulibs/drulibs (3rd party static CSS/JS libraries)

Security related commands:

drush sec
drush pm:list --status=enabled --no-core --format="table" --fields="name,version"

composer show drupal/*
composer show --outdated drupal/*
composer show -D --outdated

---

Update commands:

composer require drupal/core:8.8.4 --update-with-dependencies
composer update drupal/core-recommended --with-dependencies --no-dev

composer update --dry-run
composer why-not drush/drush

COMPOSER_MEMORY_LIMIT=-1 composer update

---

General, useful commands:

composer show -s
composer show -p
composer show -i

---

Local dev commands

// Normalize composer.json in the working directory
composer normalize

Use https://github.com/wikimedia/composer-merge-plugin to add extra composer.json files.
Example for webform module: https://git.drupalcode.org/project/webform/-/blob/6.2.x/composer.libraries.json