In following the instructions at https://www.drupal.org/docs/8/update/update-core-via-composer, prior to updating core from 8.5.3 to 8.6.12, when I attempt to go through the list of available module updates

composer outdated "drupal/*

the very first update:

composer update drupal/admin_toolbar --with-dependencies

results in:

Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - don't install drupal/core 8.6.12|remove drupal/drupal dev-master
    - don't install drupal/core 8.6.12|remove drupal/drupal dev-master
    - Installation request for drupal/drupal dev-master -> satisfiable by drupal/drupal[dev-master].
    - Installation request for drupal/core (locked at 8.6.12, required as ^8.6) -> satisfiable by drupal/core[8.6.12].

Following are the contents of my composer.json file:

    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
    "drupal/core": "^8.6",
    "composer/installers": "^1.0.24",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/console": "~1.0",
        "drupal/migrate_d2d": "3.x-dev",
        "drupal/codesnippet": "^1.6",
        "drupal/nexus": "^1.0@beta",
        "drupal/social_media_links": "^2.2",
        "drupal/twitter_block": "^2.1",
        "drupal/nocaptcha_recaptcha": "1.x-dev",
        "drupal/adsense": "^1.0",
        "drupal/pathauto": "^1.0",
        "drupal/admin_toolbar": "^1.19",
        "drupal/recaptcha": "^2.2",
        "drupal/blazy": "^1.0@RC",
        "drupal/calendar": "1.x-dev",
        "drupal/computed_field": "^2.0@alpha",
        "drupal/crop": "^1.2",
        "drupal/date": "1.x-dev",
        "drupal/dropzonejs": "^1.0@alpha",
        "drupal/embed": "^1.0",
        "drupal/entity_browser": "^1.1",
        "drupal/entity_embed": "^1.0@beta",
        "drupal/image_widget_crop": "^2.0",
        "drupal/languageicons": "1.0-beta1",
        "drupal/media_entity_document": "^1.1",
        "drupal/media_entity_image": "^1.2",
        "drupal/media_entity_instagram": "^1.4",
        "drupal/media_entity_slideshow": "^1.2",
        "drupal/media_entity_twitter": "^1.3",
        "drupal/scheduler": "^1.0@RC",
        "drupal/simple_gmap": "^1.3",
        "drupal/views_field_view": "^1.0@beta",
        "drupal/views_php": "1.x-dev",
        "drupal/webform": "^5.0@beta",
        "drush/drush": "9.0.0-beta7",
        "drupal/social_login": "2.72",
        "drupal/likebtn": "^2.13",
        "drupal/drupal8_zymphonies_theme": "^1.3"
    "replace": {
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php.",
            "This file specifies the packages.drupal.org repository.",
            "You can read more about this composer repository at:",
        "merge-plugin": {
            "include": [
            "recurse": false,
            "replace": false,
            "merge-extra": false
        "installer-paths": {
            "core": ["type:drupal-core"],
            "modules/contrib/{$name}": ["type:drupal-module"],
            "profiles/contrib/{$name}": ["type:drupal-profile"],
            "themes/contrib/{$name}": ["type:drupal-theme"],
            "drush/contrib/{$name}": ["type:drupal-drush"],
            "modules/custom/{$name}": ["type:drupal-custom-module"],
            "themes/custom/{$name}": ["type:drupal-custom-theme"]
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": [
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"
  • Why not simply composer update --with-dependencies? Maybe you also can fix your issue by removing your lockfile first.
    – leymannx
    Mar 17, 2019 at 19:56
  • With regards to just doing the global update, there are recommendations all over the place (including on D.O.) that doing the contrib modules first is preferable.
    – JAyenGreen
    Mar 17, 2019 at 19:57
  • You do have your site locally? And update that first, do you? You have a backup of your database and your code checked in Git, right? So just try it out. And when it doesn't work, simply restore everything.
    – leymannx
    Mar 17, 2019 at 20:00
  • Removing the lock file changed nothing. Attempting the global update...
    – JAyenGreen
    Mar 17, 2019 at 20:01
  • 1
    That resulted in the same, but I did find a reference to the issue with a resolution that works. Adding answer.
    – JAyenGreen
    Mar 17, 2019 at 20:48

2 Answers 2


The problem, in part or in whole, turns out to be related to the d.o. instructions to create the composer implementation with drupal/drupal. This doesn't work when then subsequently updating.

The issue is discussed in this issue and the composer command project mentioned in it, here resolved my issue.

  • That does present as the same cause, but not as the same symptom, ie if the question regards converting a site not managed by composer to one that is, what would cause someone to read it if, like me, their site was set up with composer originally, unless they just start reading all questions with descriptions that present a fringe contextual connection?
    – JAyenGreen
    Mar 18, 2019 at 12:24

Had a similar problem and the only solution I found working was to use an older version of composer.

I downloaded composer 1.7.2 and installed it at /usr/local/bin/composer1.7.2 and than I was able to run

composer1.7.2 update --with-dependencies

Which run without any problems.

I picked this tip from this issue but I had not seen this one which seems to propose a different workaround which might be worth a try.

Not the answer you're looking for? Browse other questions tagged or ask your own question.