Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
By ivk on
Dear forum members,
I installed Drupal (11.3.9) using the following line:
composer create-project drupal/recommended-project my_site_name.
When I try to update Drupal to 11.3.10 using the following line:
composer update "drupal/core-*" --with-all-dependencies,
I get the following message:
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Problem 1
- Root composer.json requires drupal/core-recommended 11.3.9 -> satisfiable by drupal/core-recommended[11.3.9].
- drupal/core-recommended 11.3.9 requires drupal/core 11.3.9 -> found drupal/core[11.3.9] but these were not loaded, because they are affected by security advisories ("SA-CORE-2026-004"). Review the advisory details above for more information. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
I have searched the internet to find out what this means and what I need to do to solve it.
Because it is all new to me, it is (unfortunately still) too cryptic for me.
Can someone explain to me what the above means and what I need to do to solve this?
Thanks in advance!
Comments
Please post your composer
Please post your composer.json here, and also post the output of
composer prohibits drupal/core 11.3.10.Contact me to contract me for D7 -> D10/11 migrations.
Thank you for your reply
This is the content of the file "composer.json" in the folder "drupal":
This is the output of the command
composer prohibits drupal/core 11.3.10:Which make sense because my core folder is in: "drupal/web/core",
but that is how it was installed by the command:
"composer create-project drupal/recommended-project my_site_name".
In the root (drupal/web) there is no file "composer.json".
I hope that I have given you sufficient information with this.
composer.json & output
Sorry for the delay. For some reason my original reply is placed in a queue to be checked by a moderator.
The content of "drupal/composer.json" is:
The output of the command: "composer prohibits drupal/core 11.3.10"
Which makes sense because the folder "core" is not in the folder "drupal" but in the folder "drupal/web" as is installed by the command "composer create-project drupal/recommended-project my_site_name".
When I enter the following command: "composer update "drupal/web/core-*" --with-all-dependencies",
the output is:
It wouldn't be drupal/core,
It wouldn't be
drupal/web/core, as what you are calling is not a path, but rather a library name. The namespace isdrupaland the package iscore. The reason I asked you to try that, is becausedrupal/coreis listed as a dependency ofdrupal/core-recommended. Often, when core-recommended cannot be updated, it's an issue of a conflict with the underlyingdrupal/corelibrary. It's a bit strange to me that you got the result you did when executing the command you did, but I think that we can skip passed it. There as a security exploit found that has been resolved as of 11.3.11, so you should try upgrading to that according to your standard upgrade process. If that does not work, please update us once more, with the command and output (what you provided before was very helpful, I just think it can be resolved by skipping 11.3.10).Contact me to contract me for D7 -> D10/11 migrations.
I encountered a similar issue
I encountered a similar issue.
Composer update on a 11.3.9 install was giving me the same issue.
Gave me a more understandable error:
A Guzzle security issue is blocking the update.
It's not recommended to bypass security advisories, but being a minor issue, I "ignored" the issue like mentioned.
The update ran perfectly afterwards.
Check Composer issues for Drupal core
Recently there have been a few Symfony security updates, which makes Composer block Drupal core updates.
So it's good to check if there is a new Composer issue for Drupal core, where they are usually quickly reported, fixed and a workaround shared. See for example: