diff --git a/composer.json b/composer.json
index 9167594c39..9e346bd26f 100644
--- a/composer.json
+++ b/composer.json
@@ -20,7 +20,7 @@
         "behat/mink-goutte-driver": "^1.2",
         "behat/mink-selenium2-driver": "^1.4",
         "composer/composer": "^1.9.1",
-        "drupal/coder": "^8.3.7",
+        "drupal/coder": "^8.3.8",
         "mikey179/vfsstream": "^1.6.8",
         "phpunit/phpunit": "^8.4.1",
         "phpspec/prophecy": "^1.7",
diff --git a/composer.lock b/composer.lock
index 08d13388eb..778f70f642 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "aff3c3526437393da89a279456ad596b",
+    "content-hash": "6e6f6ea4db3fdcc1abfb5abe30e99cff",
     "packages": [
         {
             "name": "asm89/stack-cors",
@@ -699,10 +699,16 @@
         {
             "name": "drupal/core-project-message",
             "version": "9.0.x-dev",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/drupal/core-project-message.git",
+                "reference": "5984bad5e53782a946cccfab14deda84bef7d190"
+            },
             "dist": {
-                "type": "path",
-                "url": "composer/Plugin/ProjectMessage",
-                "reference": "0691ca6beba657e6da57a893b1c6da757d16afc8"
+                "type": "zip",
+                "url": "https://api.github.com/repos/drupal/core-project-message/zipball/5984bad5e53782a946cccfab14deda84bef7d190",
+                "reference": "5984bad5e53782a946cccfab14deda84bef7d190",
+                "shasum": ""
             },
             "require": {
                 "composer-plugin-api": "^1.1",
@@ -729,10 +735,16 @@
         {
             "name": "drupal/core-vendor-hardening",
             "version": "9.0.x-dev",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/drupal/core-vendor-hardening.git",
+                "reference": "f4ace36ae2bc4331024f7bdfb7f189e5050d7e23"
+            },
             "dist": {
-                "type": "path",
-                "url": "composer/Plugin/VendorHardening",
-                "reference": "0b015340af38f90df46923a934d0b22026134f18"
+                "type": "zip",
+                "url": "https://api.github.com/repos/drupal/core-vendor-hardening/zipball/f4ace36ae2bc4331024f7bdfb7f189e5050d7e23",
+                "reference": "f4ace36ae2bc4331024f7bdfb7f189e5050d7e23",
+                "shasum": ""
             },
             "require": {
                 "composer-plugin-api": "^1.1",
@@ -4262,24 +4274,25 @@
         },
         {
             "name": "drupal/coder",
-            "version": "8.3.7",
+            "version": "8.3.8",
             "source": {
                 "type": "git",
                 "url": "https://git.drupalcode.org/project/coder.git",
-                "reference": "c11c2957653bdbfd68adc851692d094b43d39221"
+                "reference": "e53e75b45842a5d2b454b08c318a17f57339e60e"
             },
             "require": {
                 "ext-mbstring": "*",
-                "php": ">=5.5.9",
-                "squizlabs/php_codesniffer": "^3.4.1",
+                "php": ">=7.0.8",
+                "squizlabs/php_codesniffer": "^3.5.4",
                 "symfony/yaml": ">=2.0.5"
             },
             "require-dev": {
-                "phpunit/phpunit": "^4.0 || ^5.0 || ^6.0 || ^7.0"
+                "phpstan/phpstan": "^0.12.5",
+                "phpunit/phpunit": "^6.0 || ^7.0"
             },
             "type": "phpcodesniffer-standard",
             "autoload": {
-                "psr-0": {
+                "psr-4": {
                     "Drupal\\": "coder_sniffer/Drupal/",
                     "DrupalPractice\\": "coder_sniffer/DrupalPractice/"
                 }
@@ -4295,7 +4308,7 @@
                 "phpcs",
                 "standards"
             ],
-            "time": "2019-12-07T16:00:28+00:00"
+            "time": "2020-03-08T19:03:35+00:00"
         },
         {
             "name": "easyrdf/easyrdf",
diff --git a/composer/Metapackage/CoreRecommended/composer.json b/composer/Metapackage/CoreRecommended/composer.json
index 31e54857ef..9831107ce6 100644
--- a/composer/Metapackage/CoreRecommended/composer.json
+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -14,6 +14,8 @@
         "doctrine/annotations": "v1.8.0",
         "doctrine/lexer": "1.2.0",
         "doctrine/reflection": "v1.1.0",
+        "drupal/core-project-message": "9.0.x-dev",
+        "drupal/core-vendor-hardening": "9.0.x-dev",
         "egulias/email-validator": "2.1.17",
         "guzzlehttp/guzzle": "6.5.2",
         "guzzlehttp/promises": "v1.3.1",
diff --git a/composer/Metapackage/DevDependencies/composer.json b/composer/Metapackage/DevDependencies/composer.json
index beeb2d86ee..dc6e09db0f 100644
--- a/composer/Metapackage/DevDependencies/composer.json
+++ b/composer/Metapackage/DevDependencies/composer.json
@@ -11,7 +11,7 @@
         "behat/mink-goutte-driver": "^1.2",
         "behat/mink-selenium2-driver": "^1.4",
         "composer/composer": "^1.9.1",
-        "drupal/coder": "^8.3.7",
+        "drupal/coder": "^8.3.8",
         "easyrdf/easyrdf": "^0.9",
         "justinrainbow/json-schema": "^5.2",
         "mikey179/vfsstream": "^1.6.8",
diff --git a/composer/Metapackage/PinnedDevDependencies/composer.json b/composer/Metapackage/PinnedDevDependencies/composer.json
index 987f92a6ea..bfa2bc18f2 100644
--- a/composer/Metapackage/PinnedDevDependencies/composer.json
+++ b/composer/Metapackage/PinnedDevDependencies/composer.json
@@ -17,7 +17,7 @@
         "composer/spdx-licenses": "1.5.3",
         "composer/xdebug-handler": "1.4.1",
         "doctrine/instantiator": "1.3.0",
-        "drupal/coder": "8.3.7",
+        "drupal/coder": "8.3.8",
         "easyrdf/easyrdf": "0.9.1",
         "fabpot/goutte": "v3.3.0",
         "instaclick/php-webdriver": "1.4.7",