When I try to use composer to update Drupal, it fails to follow through, and gives me several abandoned items.

Not sure where to go from here, but maybe someone can give pointers on what might be causing the issues, and how to resolve the abandoned packages?

Sorry if this is vague. I don't know what next steps should be.

[user@ip-000-00-00-000 sitefolder]$ sudo -u nginx composer update drupal --with-dependencies
No composer.json in current directory, do you want to use the one at /var/lib/nginx/sitefolder? [Y,n]? Y
> DrupalProject\composer\ScriptHandler::checkComposerVersion
Package "drupal" listed for update is not installed. Ignoring.
Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package phpunit/phpunit-mock-objects is abandoned, you should avoid using it. No replacement was suggested.
Package webflo/drupal-core-require-dev is abandoned, you should avoid using it. Use drupal/core-dev instead.
Package zendframework/zend-diactoros is abandoned, you should avoid using it. Use laminas/laminas-diactoros instead.
Package zendframework/zend-escaper is abandoned, you should avoid using it. Use laminas/laminas-escaper instead.
Package zendframework/zend-feed is abandoned, you should avoid using it. Use laminas/laminas-feed instead.
Package zendframework/zend-stdlib is abandoned, you should avoid using it. Use laminas/laminas-stdlib instead.
Writing lock file
Generating autoload files

I also did "composer outdated -Dm" to see what I'd get, if it helps:

sudo -u nginx composer outdated -Dm
No composer.json in current directory, do you want to use the one at /var/lib/nginx/sitefolder? [Y,n]? Y
drupal/browserclass            1.0.0-alpha1 1.0.0-alpha2 Adds a browser class to the body tag.
drupal/core                    8.7.10       8.8.2        Drupal is an open source content management platform powering millions of websites...
webflo/drupal-core-require-dev 8.7.10       8.8.1        require-dev dependencies from drupal/core

I tried composer why-not drupal/core:8.8.1, and 8.8.2 and got:

webflo/drupal-core-require-dev  8.7.10  requires          drupal/core (8.7.10)                                 
drupal/core                     8.8.1   requires          typo3/phar-stream-wrapper (^3.1.3)                   
drupal-composer/drupal-project  -       does not require  typo3/phar-stream-wrapper (but v2.1.3 is installed)  
drupal/core                     8.8.1   requires          pear/archive_tar (^1.4.9)                            
drupal-composer/drupal-project  -       does not require  pear/archive_tar (but 1.4.8 is installed)  

I've also attempted to replace the webflow/drupal-core-require-dev item, and when I did the reinstall, using "composer require --dev drupal/core-dev", I ran into a confusing result:

 Problem 1
    - Conclusion: don't install drupal/core-dev 8.8.2
    - Conclusion: don't install drupal/core-dev 8.8.1
    - Conclusion: don't install drupal/core-dev 8.8.0
    - Conclusion: don't install drupal/core-dev 8.8.0-rc1
    - Conclusion: don't install drupal/core-dev 8.8.0-beta1
    - Installation request for webflo/drupal-core-require-dev (locked at 8.7.10, required as ^8.7.0) -> satisfiable by webflo/drupal-core-require-dev[8.7.10].
    - Conclusion: don't install drupal/core-dev 8.9.x-dev
    - Conclusion: don't install drupal/core-dev 8.8.x-dev
    - Can only install one of: drupal/core[8.8.0-alpha1, 8.7.10].
    - Can only install one of: drupal/core[8.8.0-alpha1, 8.7.10].
    - Can only install one of: drupal/core[8.8.0-alpha1, 8.7.10].
    - drupal/core-dev 8.8.0-alpha1 requires drupal/core 8.8.0-alpha1 -> satisfiable by drupal/core[8.8.0-alpha1].
    - Installation request for drupal/core-dev ^8.8 -> satisfiable by drupal/core-dev[8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.2, 8.8.x-dev, 8.9.x-dev].
    - Installation request for drupal/core (locked at 8.7.10, required as ^8.7.0) -> satisfiable by drupal/core[8.7.10].

Installation failed, reverting ./composer.json to its original content.
  • 1
    Firstly, I think composer update drupal is flawed. It would probably be drupal/*, drupal/core, webflo/drupal-something depending on what composer project you used (if any). Check these docs as they cover quite a few scenarios. Feb 4 '20 at 19:54
  • @stevekeiretsu Not sure if it's what you mean, but I tried with 'composer update drupal/core' and got the same result
    – turpentyne
    Feb 4 '20 at 19:55
  • sorry, I accidentally submitted the comment before I finished writing it. I have now included the link to the docs which got me through similar issues last week. Feb 4 '20 at 19:57
  • What does composer why-not drupal/core:8.8.1 and composer why-not drupal/core:8.8.2 show? Bit I highly suspect it is the webflo/drupal-core-require-dev requirement, as the project is abandoned in favor of drupal/core-recommended.
    – mpdonadio
    Feb 4 '20 at 21:18
  • @mpdonadio I suspect that's the case too, after reviewing the info in stevekeirestsu 's link. I tried removing it and re-adding and ran into errors. I add the why-not results for 8.8.1 to the question
    – turpentyne
    Feb 4 '20 at 21:44

As other's have mentioned, drupal/core-recommended should be used going forward.


composer remove webflo/drupal-core-require-dev --no-update composer require drupal/core-recommended --no-update composer update webflo/drupal-core-require-dev drupal/core drupal/core-recommended --with-dependencies

You could also try adding composer require drupal/core:8.8.1 specifically, before running the update command.

  • monk , in the end, it was a combination of removing webflow/drupal-core-require-dev as well as the lock file. It didn't work at first because i inexplicably typed ".log" instead of ".lock"
    – turpentyne
    Feb 6 '20 at 15:44

Sleepingmonk's answer is good, above. What most helped me, though, was to follow the information in the link, provided by stevekeiretsu in one of the sub-comments:


For me, it was a combination of removing "webflo/drupal-core-require-dev" as well as the 'composer.lock' file.


I had the same problem. You have to migrate from webflo/drupal-core-strict to drupal/core-recommended.

Solution and steps are here : https://www.drupal.org/docs/8/update/update-core-via-composer#migrate-webflo-drupal-core-strict-to-core-recommended

The simplest way to accomplish this migration and avoid conflicts is to remove your composer.lock file entirely as part of the update. However, doing so will mean that other dependencies (e.g. contributed Drupal modules) might be updated, too. Following these steps will ensure that you update exactly what you intend:

  1. composer update # To update any dependencies as a separate step.
  2. git add composer.lock; git commit # Save the updates as a separate commit.
  3. composer remove webflo/drupal-core-strict --no-update
  4. composer remove drupal/core --no-update
  5. composer require 'composer/installers:^1.7' --no-update
  6. rm composer.lock
  7. rm -rf vendor # Also helps avoid conflicts.
  8. composer require drupal/core-recommended:^8.8 --update-with-dependencies
  9. git add composer.json composer.lock; git commit -m "Update Drupal to 8.8.0 and use drupal/core-recommended instead of webflo/drupal-core-strict"

For a strange reason, I couldn't upgrade from 8.8.1 to 8.8.2 with webflo/drupal-core-require-dev installed. To resolve it quickly I just:

// Remove webflo
composer remove --dev webflo/drupal-core-require-dev

// Add drupal/core-dev  (This step is not mandatory, only for dev purpose)
composer require --dev drupal/core-dev 

// Update Drupal core from 8.8.1 to 8.8.2
composer update drupal/core --with-dependencies

Hope this helps.


As other answered, you can try to migrate to drupal/core-recommended. I found this Composer plugin very easy to use :


I've successfully tested it on several Drupal installation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.