I am trying to update Drupal core to 8.3 but am running into difficulties.

At the bottom of the page is the composer.json file I am starting with.

If i change "drupal/core": "~8.2" => "drupal/core": "~8.3" and then run composer update drupal/core --with-dependencies I get the following issues which i am not sure how to resolve this as they are not contained in the composer.json file i have included below.

Your requirements could not be resolved to an installable set of packages.

   Problem 1
    - drupal/core 8.3.0 requires symfony/psr-http-message-bridge ^1.0 -> satisfiable by symfony/psr-http-message-bridge[1.0.x-dev].
    - drupal/core 8.3.x-dev requires symfony/psr-http-message-bridge ^1.0 -> satisfiable by symfony/psr-http-message-bridge[1.0.x-dev].
    - drupal/core 8.4.x-dev requires symfony/psr-http-message-bridge ^1.0 -> satisfiable by symfony/psr-http-message-bridge[1.0.x-dev].
    - Conclusion: don't install symfony/psr-http-message-bridge 1.0.x-dev
    - Conclusion: don't install drupal/core 8.3.0-rc2
    - Conclusion: don't install drupal/core 8.3.0-rc1
    - Conclusion: don't install drupal/core 8.3.0-beta1
    - Installation request for symfony/psr-http-message-bridge v0.2 -> satisfiable by symfony/psr-http-message-bridge[v0.2].
    - Conclusion: remove symfony/dom-crawler v3.2.6
    - Installation request for drupal/core ~8.3 -> satisfiable by drupal/core[8.3.0, 8.3.0-alpha1, 8.3.0-beta1, 8.3.0-rc1, 8.3.0-rc2, 8.3.x-dev, 8.4.x-dev].
    - Conclusion: don't install symfony/dom-crawler v3.2.6
    - drupal/core 8.3.0-alpha1 requires symfony/dom-crawler >=2.8.13 <3.0 -> satisfiable by symfony/dom-crawler[2.8.x-dev, v2.8.13, v2.8.14, v2.8.15, v2.8.16, v2.8.17, v2.8.18, v2.8.19].
    - Can only install one of: symfony/dom-crawler[2.8.x-dev, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.13, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.14, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.15, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.16, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.17, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.18, v3.2.6].
    - Can only install one of: symfony/dom-crawler[v2.8.19, v3.2.6].
    - Installation request for symfony/dom-crawler (locked at v3.2.6) -> satisfiable by symfony/dom-crawler[v3.2.6].

original composer.json

"name": "drupal/drupal",
"description": "Drupal is an open source content management platform powering millions of websites and applications.",
"type": "project",
"license": "GPL-2.0+",
"require": {
    "drupal/core": "~8.2",
    "drupal/backup_migrate": "4.x-dev",
    "composer/installers": "^1.0.21",
    "wikimedia/composer-merge-plugin": "~1.3",
    "drupal/console": "^1.0",
    "drupal/file_browser": "^1.0@alpha",
    "enyo/dropzone": "4.2.0",
    "desandro/masonry": "3.3.1",
    "desandro/imagesloaded": "3.1.8",
    "drupal/admin_toolbar": "^1.18",
    "drupal/ctools": "^3.0@alpha",
    "drupal/devel": "^1.0@beta",
    "drupal/migrate_tools": "^3.0",
    "drupal/migrate_plus": "^3.0",
    "drupal/media_entity": "^1.6",
    "drupal/media_entity_document": "^1.1",
    "drupal/media_entity_image": "^1.2",
    "drupal/inline_entity_form": "^1.0@beta",
    "drupal/entity_embed": "^1.0@beta",
    "drupal/entity_browser": "^1.0@beta",
    "paquettg/php-html-parser": "^1.7",
    "drupal/better_exposed_filters": "^3.0@alpha",
    "drupal/workbench_access": "^1.0@alpha",
    "drupal/webform": "^5.0@beta",
    "j7mbo/twitter-api-php": "^1.0",
    "nesbot/carbon": "^1.22",
    "Drupal/userprotect": "^1.0",
    "drupal/config_ignore": "^1.2",
    "Drupal/permissions_by_term": "^1.16",
    "Drupal/views_menu_children_filter": "^1.0@alpha",
    "drupal/sitemap": "^1.2",
    "drupal/xmlsitemap": "^1.0@alpha",
    "drupal/simple_sitemap": "^2.8",
    "drupal/redirect": "^1.0@alpha",
    "drupal/metatag": "^1.0",
    "drupal/acl": "^1.0@alpha",
    "drupal/examples": "1.x-dev",
    "drupal/honeypot": "^1.23",
    "drupal/field_collection": "^1.0@alpha",
    "drupal/dropzonejs": "^1.0@alpha",
    "drupal/embed": "^1.0@RC",
    "drupal/pathauto": "^1.0@RC",
    "drupal/rabbit_hole": "^1.0@beta",
    "drupal/entity_reference_display": "^1.0",
    "drupal/field_group": "^1.0@RC",
    "drupal/layouter": "^1.0",
    "drupal/mailsystem": "^4.1",
    "drupal/mimemail": "^1.0@alpha",
    "drupal/permissions_by_term": "^1.17",
    "drupal/content_access": "1.x-dev",
    "drupal/rules": "^3.0@alpha",
    "drupal/smart_trim": "^1.0",
    "drupal/taxonomy_menu": "^3.3",
    "drupal/token": "^1.0@RC",
    "drupal/typed_data": "^1.0@alpha",
    "drupal/video_embed_field": "^1.4",
    "drupal/views_infinite_scroll": "^1.3",
    "drupal/noreferrer": "^1.1",
    "drupal/system_status": "^2.4",
    "drupal/google_analytics": "^2.1"
"replace": {

"minimum-stability": "dev",
"prefer-stable": true,
"config": {
    "preferred-install": "dist",
    "autoloader-suffix": "Drupal8"
"extra": {
    "_readme": [
        "By default Drupal loads the autoloader from ./vendor/autoload.php.",
        "To change the autoloader you can edit ./autoload.php."
    "merge-plugin": {
        "include": [
        "recurse": false,
        "replace": false,
        "merge-extra": false
    "installer-paths": {
        "modules/contrib/{$name}": [
        "modules/custom/{$name}": [
        "libraries/{$name}": [
        "profiles/contrib/{$name}": [
        "themes/contrib/{$name}": [
        "themes/custom/{$name}": [
"autoload": {
    "psr-4": {
        "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
"scripts": {
    "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
    "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
    "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
    "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
"dependencies": {
    "backupmigrate/core": "dev-master",
    "psr/log": "dev-master"
"repositories": [
        "type": "composer",
        "url":  "https://packages.drupal.org/8"
        "type": "package",
        "package": {
            "name": "desandro/masonry",
            "version": "3.3.1",
            "type": "drupal-library",
            "dist": {
                "url": "https://github.com/desandro/masonry/archive/v3.3.1.zip",
                "type": "zip"
        "type": "package",
        "package": {
            "name": "desandro/imagesloaded",
            "version": "3.1.8",
            "type": "drupal-library",
            "dist": {
                "url": "https://github.com/desandro/imagesloaded/archive/v3.1.8.zip",
                "type": "zip"
        "type": "package",
        "package": {
            "name": "enyo/dropzone",
            "version": "4.2.0",
            "type": "drupal-library",
            "source": {
                "url": "https://github.com/enyo/dropzone",
                "type": "git",
                "reference": "origin/master"
        "type": "vcs",
        "url": "https://github.com/backupmigrate/backup_migrate_core"


  • I ran into this last week, and fixed it, but am not 100% sure what I did was proper (I also use webflo/drupal-core-strict). I would like to see a definitive answer about this.
    – mpdonadio
    Apr 18, 2017 at 14:34

4 Answers 4


Similar to @rreiss I had to delete .lock. This is what worked for me:

rm -rf vendor && rm -rf docroot/core && rm -rf docroot/modules/contrib && rm -f composer.lock

composer require drupal/core:8.3.1 --update-with-dependencies

line one could be unique to your project, confirm by looking up installer-paths in your composer.json.


Just ran into this same thing. To fix I backed-up/deleted the /vendor directory and ran 'composer update' again so Composer would re-download all dependencies. I think installed dependencies vs. required get out of sync.

  • 2
    This is how I end up fixing similar Composer issues. I find it a frustrating 'solution' because it feels like a hack. If the purpose of Composer is to manage my dependencies then I kind of DO expect Composer to handle this kind of thing. As it is (with this 'fix'), Composer seems more like a tool to INSTALL my Drupal dependencies. Again this feels like a long winded hack because this is supposed to be an improvement over the 'download the new zip and overwrite the existing Drupal install' method.
    – RominRonin
    Apr 19, 2017 at 13:11
  • 1
    I've experienced the same issue and I also had to delete composer.lock .. drupal.org/node/2836351#comment-12056279
    – rreiss
    Apr 26, 2017 at 10:54

I had a very similar issue when attempting to upgrade from 8.3.7 to 8.4.0. I think I found the culprit.

In the DOCROOT composer.json file, I see the following lines:

"merge-plugin": {
    "include": [
    "recurse": false,
    "replace": false,
    "merge-extra": false

So this directs the DOCROOT composer.json file to refer to the core/composer.jsonfile and also require those dependencies. The problem is that it is looking at the dependencies from your currently installed version of Drupal, whereas the upgraded version has new dependencies. This creates the conflict we're seeing.

Here is the solution I found which works. It does not require deleting any files or modules.

1)Download a copy of the core/composer.json file from the tarball of the version of Drupal you are upgrading to.

2)In your current installation, replace the core/composer.json file with the new version you just downloaded.

3)Update your DOCROOT composer.json file with "drupal/core:~8.x.x"(whatever you're upgrading to).

4)Run composer update --with-dependencies as usual. This time, the update should proceed. Then apply database/entity updates, rebuild the cache, etc. etc.

I'm a Windows user and definitely more of a site builder, so I won't even try to post command-line prompts to do these things in Linux. And I'm not sure if this is a "proper" solution, or even why that above code blocks the upgrade, but this is what worked for me!


Just noting that this seemed to work for me for core update from 8.2.3 > 8.3.7. Note my Drupal 8 install used this: https://github.com/drupal-composer/drupal-scaffold which has this directory structure:


  • Put site into maintenance mode: /admin/config/development/maintenance
  • Run this command in the root of the site: rm -rf vendor && rm -rf web/core && rm -f composer.lock
  • Run this command in the root of the site: composer require drupal/core:8.3.7 --update-with-dependencies
  • Go to /update.php (or drush updb) and run the updates. It will say there are 17 to run. It will probably return errors, if so, go to /update.php and run updates again (this time it will say there are less to run). Go to home page when it is done.
  • Check over the site.
  • Take site out of maintenance mode: /admin/config/development/maintenance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.