I have site (which is originally installed also with composer) with drupal core version 8.7.2. I'm trying to update it to latest 8.7.8. When I do:

composer outdated "drupal/*"

I get the list of all outdate and for core I get row:

drupal/core                       8.7.2       8.7.8       Drupal is an open source content management platform powering millions of websites ..

But when I try:

composer update drupal/core --with-dependencies

I get:

Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update
Package phpunit/phpunit-mock-objects is abandoned, you should avoid using it. No replacement was suggested.
Writing lock file
Generating autoload files

In composer.json core is added under require as (I just followed install docs - didn't change anything by hand):

"drupal/core": "^8.7.0",

That was suspicious to me so I tried replacing it with:

"drupal/core": "8.*",

But result was the same - nothing to update.

That message about phpunit/phpunit-mock-objects dependency is in green so I doubt that it causes this update to fail, but I'm not sure.

Why composer says that there's nothing to update?


Tried also:

composer prohibits drupal/core:8.7.8

and it says:

webflo/drupal-core-require-dev  8.7.2  requires  drupal/core (8.7.2)

And I really have inside composer.json:

"require-dev": {
    "webflo/drupal-core-require-dev": "^8.7.0"

Also tried:

composer update drupal/core --with-dependencies --no-dev

which removed dev dependencies, but also didn't update drupal core. How to solve this?

2 Answers 2


Normally you can simply update core and all extensions in a single pass:

composer update

Only if this doesn't work, try to update core in a separate step by following the procedures described in the drupal composer project:

composer update drupal/core webflo/drupal-core-require-dev "symfony/*" --with-dependencies

See https://github.com/drupal-composer/drupal-project

  • And if I can just add - if this also fails "composer prohibits" command can be used to find out what exactly is stopping the update so that dependency can also be added.
    – MilanG
    Oct 23, 2019 at 11:57

Solved it. I had to add that "webflo/drupal-core-require-dev" to update command to be updates as well, because without that core couldn't be updated:

composer update drupal/core "webflo/drupal-core-require-dev" --with-dependencies

Saw that in "known issues" section. :/ It's really strange - what's the purpose of --with-dependencies when I have to add dependencies manually after all...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.