Drupal 10.4 Removes Direct Module Installs, Shifts to Composer

In the 10.4 update, Drupal officially discontinued the option to install modules directly from URLs via its user interface. This change aligns with the platform's shift towards modern project maintenance and integration with the Symfony framework, which aims to improve security and efficiency.

André Angelantoni, a well-known figure in the Drupal community, discussed this development in a recent post titled "The End of Direct Module Installs!" He explained that this update removes the ability to install modules from the "Add new module," "Add new theme," and "Add new module or theme" pages. 

"This is actually exactly what is required as Drupal moves into a world fully embracing the Symfony framework and modern project maintenance techniques."

André commented.

The decision comes in response to the increasing complexity of modern Drupal modules, many of which now require additional libraries. André highlighted this issue, noting that it's 

"no longer possible to trust the installation of a module simply by downloading its code." 

Composer, a widely used PHP dependency manager, has become essential for managing these libraries and ensuring secure, efficient module installations.

While some users might worry that this change eliminates the ability to install modules via the user interface, André reassured that the new Project Browser provides an alternative. 

“Can modules still be installed from the UI? Why yes, using the new Project Browser!” 

he confirmed.

This update signals a significant step forward for Drupal, which is adopting more robust project management practices and reinforcing the use of Composer in its workflows. For more details, the official change record can be found on Drupal.org.