how does one fix the following D8 update problem ...

Now getting the following composer output:
----

php -c ~/php.ini composer.phar  update  symfony/psr-http-message-bridge
Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - The requested package drupal/core (locked at 8.2.8, required as 8.3.1) is satisfiable by drupal/core[8.2.8] but these conflict with your requirements or minimum-stability.
  Problem 2
    - The requested package symfony/psr-http-message-bridge v0.2 is satisfiable by symfony/psr-http-message-bridge[v0.2] but these conflict with your requirements or minimum-stability.

----

the composer.json looks like the following:

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/core": "8.3.1",
        "drupal/commerce": "2.x-dev",
        "drupal/scheduler": "8.1.0-alpha2",
        "drupal/module_filter": "^8.3",
        "drupal/xmlsitemap": "8.1.0alpha2",
        "drupal/admin_toolbar": "^8.1",
        "drupal/ultimate_cron": "8.2.0alpha1",
        "drupal/token": "8.1.0rc1",
        "drupal/imce": "8.1.4",
        "drupal/inline_entity_form": "~1.0",
        "drupal/pathauto": "1.0.0-rc1",
        "drupal/views_slideshow": "8.4.3",
        "symfony/psr-http-message-bridge": "1.0.x-dev"
    },
    "replace": {
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer",
            "Drupal\\composer_manager\\Composer\\": "modules/composer_manager/src/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "drupal-rebuild": "Drupal\\composer_manager\\Composer\\Command::rebuild",
        "drupal-update": "Drupal\\composer_manager\\Composer\\Command::update"
    },
    "repositories": {
        "drupal": {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        }
    }
}

Given the directives above, what is causing composer to still think that "v0.2" of the symfony/psr-http-message-bridge package is still be requested?

What sequence of composer commands are needed to tell composer to "unlock" the old versions and update them?

I fixed the vexing problem described above with the following methodology:

1. made a backup of the site.
2. deleted the core and vendor directory trees.
3. deleted the composer.lock file
4. in the composer.json file removed all but the needed - require drupal/core entries from its require section.
5. ran composer install (general not other parameters)
6. ran composer update (general not other parameters)
- the above seems to have rebuilt the vendor directory and created a new composer.lock file
7. ran composer update drupal/core (require set at 8.3.2)
8. ran composer update (after one at a time added back various drupal8 modules previously setup in composer and ran composer update until everything was updated again.