Dear forum members,
I installed Drupal (11.3.9) using the following line:
composer create-project drupal/recommended-project my_site_name.
When I try to update Drupal to 11.3.10 using the following line:
composer update "drupal/core-*" --with-all-dependencies,
I get the following message:
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Problem 1
- Root composer.json requires drupal/core-recommended 11.3.9 -> satisfiable by drupal/core-recommended[11.3.9].
- drupal/core-recommended 11.3.9 requires drupal/core 11.3.9 -> found drupal/core[11.3.9] but these were not loaded, because they are affected by security advisories ("SA-CORE-2026-004"). Review the advisory details above for more information. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
I have searched the internet to find out what this means and what I need to do to solve it.
Because it is all new to me, it is (unfortunately still) too cryptic for me.
Can someone explain to me what the above means and what I need to do to solve this?
Thanks in advance!
Comments
Please post your composer
Please post your composer.json here, and also post the output of
composer prohibits drupal/core 11.3.10.Contact me to contract me for D7 -> D10/11 migrations.
Thank you for your reply
This is the content of the file "composer.json" in the folder "drupal":
This is the output of the command
composer prohibits drupal/core 11.3.10:Which make sense because my core folder is in: "drupal/web/core",
but that is how it was installed by the command:
"composer create-project drupal/recommended-project my_site_name".
In the root (drupal/web) there is no file "composer.json".
I hope that I have given you sufficient information with this.
composer.json & output
Sorry for the delay. For some reason my original reply is placed in a queue to be checked by a moderator.
The content of "drupal/composer.json" is:
The output of the command: "composer prohibits drupal/core 11.3.10"
Which makes sense because the folder "core" is not in the folder "drupal" but in the folder "drupal/web" as is installed by the command "composer create-project drupal/recommended-project my_site_name".
When I enter the following command: "composer update "drupal/web/core-*" --with-all-dependencies",
the output is:
It wouldn't be drupal/core,
It wouldn't be
drupal/web/core, as what you are calling is not a path, but rather a library name. The namespace isdrupaland the package iscore. The reason I asked you to try that, is becausedrupal/coreis listed as a dependency ofdrupal/core-recommended. Often, when core-recommended cannot be updated, it's an issue of a conflict with the underlyingdrupal/corelibrary. It's a bit strange to me that you got the result you did when executing the command you did, but I think that we can skip passed it. There as a security exploit found that has been resolved as of 11.3.11, so you should try upgrading to that according to your standard upgrade process. If that does not work, please update us once more, with the command and output (what you provided before was very helpful, I just think it can be resolved by skipping 11.3.10).Contact me to contract me for D7 -> D10/11 migrations.
I encountered a similar issue
I encountered a similar issue.
Composer update on a 11.3.9 install was giving me the same issue.
Gave me a more understandable error:
A Guzzle security issue is blocking the update.
It's not recommended to bypass security advisories, but being a minor issue, I "ignored" the issue like mentioned.
The update ran perfectly afterwards.
Check Composer issues for Drupal core
Recently there have been a few Symfony security updates, which makes Composer block Drupal core updates.
So it's good to check if there is a new Composer issue for Drupal core, where they are usually quickly reported, fixed and a workaround shared. See for example:
Still no succes
I took some time to see if I could update my site using all your feedback. Sadly, still no succes.
I entered the following commands:
composer require "guzzlehttp/psr7:2.11.0 as 2.8.1"
composer update "drupal/core-*" --with -all-dependencies
Output:
Which suggestes to me that the site is updated to version 11.3.13.
I also got this output:
I cleared the chache and checked if the databse needed to be updated, which is not the case.
Still the Drupal rapport shows:
What am I doing wrong / am I overlooking and what should I do instead?
some background about me
I am not a professional site manager, but an retired electrical, hardware engineer & designer with some experience in programming, who was asked to build a site. So this is all new to me!
So far, as long as everything goes the way it's supposed to, I can manage. But if that's not the case, I still can't figure out what's going wrong.
So thank you all for helping me (and others).
Remove all minor constraints from core-recommended?
Since I left a comment 14 June which listed recent hurried Composer updates, another one arrived:
#3603733: Update guzzlehttp/psr7 to 2.12.1 and guzzlehttp/guzzle to 7.12.1
Like I wrote, please check the Composer issue for Drupal core if you get one of those baffling Composer errors after an update ... they are usually quickly reported, fixed and a workaround shared.
There is discussion if we should #3600889: Remove all minor constraints from core-recommended, everyone should feel free to share their observations about Drupal and Composer.
Drupal core uses (depends on)
Drupal core uses (depends on) Guzzle. The version of Guzzle Drupal is using has had a security release, but Drupal core is not set up to use the updated version of Guzzle yet. When updating with Composer, it is finding that Guzzle has a security hole, so default Composer settings prevent update. Unfortunately, the fix doesn't appear to be as simple as just upgrading the Guzzle version with everything still working as it was; it appears to require additional work.
You have three options that I can see:
Contact me to contract me for D7 -> D10/11 migrations.
I'm getting closer (I think)
I went with option 2 and according to the information in composer drupal is now updated to 11.3.13. But the GUI / report still shows version 11.3.9 is installed and updates are needed, even though I have cleared / rebuilt the cache multiple times and in different ways.