Composer project templates introduced in Drupal core

Traditionally, Composer-managed Drupal sites have utilized third-party template projects such as drupal-composer/drupal-project in order to build and update Drupal dependencies with Composer. Starting with Drupal 8.8.0, equivalent template projects are provided directly by Drupal core.

There are two project templates to choose from:

1. drupal/recommended-project
   The recommended project creates a new Drupal site with a "relocated document root". This means that the files "index.php" and the "core" directory and so on are placed inside a subfolder named "web" rather than being placed next to "composer.json" and the "vendor" directory at the project root. This layout is recommended because it allows you to configure your web server to only provide access to files inside the "web" directory. Keeping the vendor directory outside of the web server's document root is better for security.
2. drupal/legacy-project
   The legacy project creates a new Drupal site that has the same layout used in Drupal 8.7.x and earlier. The files "index.php", the "core" directory and so on are placed directly at the project root next to "composer.json" and the "vendor" directory. The Vendor Hardening plugin is used to ensure the security of this configuration for the Apache and Microsoft IIS web servers. Use the legacy project layout only if there is some reason why you cannot use the recommended project layout.

Both template variants will place a .editorconfig file and a .gitattributes file in the root of your project, adjusted for Drupal coding standards.

Note that the code examples below illustrate how to make this work during the 8.8.x pre-release era. Consult the documentation for more up-to-date instructions.

Use Composer to create a new project using the desired starter template:

composer -n create-project drupal/recommended-project:^8.8@dev my-project

Add new modules and themes with `composer require`:

composer require drupal/devel:^1

All of your modules and themes can be updated along with Drupal core via:

composer update

To update only Drupal core without any modules or themes, use:

composer update drupal/core-recommended --with-dependencies

For more information, see the Composer template projects README.