I successfully updated my drupal 8.7.8 site to 8.9.0 following the instructions on 'Migrate composer project for Drupal earlier than 8.8.0' Drupal documentation page, section 'Migrating from webflo/drupal-core-strict to drupal/core-recommended'.

    composer update # To update any dependencies as a separate step.
    git add composer.lock; git commit # Save the updates as a separate commit.
    composer remove webflo/drupal-core-strict --no-update
    composer remove drupal/core --no-update
    composer require 'composer/installers:^1.7' --no-update
    rm composer.lock
    rm -rf vendor # Also helps avoid conflicts.
    composer require drupal/core-recommended:^8.8 --update-with-dependencies
    git add composer.json composer.lock; git commit -m "Update Drupal to 8.8.0 and use drupal/core-recommended instead of webflo/drupal-core-strict"

Now I can't update drupal to 8.9.1.

I execute the command

composer update drupal/core-recommended --with-dependencies

> DrupalProject\composer\ScriptHandler::checkComposerVersion
Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package webflo/drupal-core-require-dev is abandoned, you should avoid using it. Use drupal/core-dev instead.
Generating autoload files
38 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
> DrupalProject\composer\ScriptHandler::createRequiredFiles

To check if the my project now uses drupal/core-recommended I executed

composer show drupal/core-recommended

name     : drupal/core-recommended
descrip. : Locked core dependencies; require this project INSTEAD OF drupal/core.
keywords :
versions : * 8.9.0
type     : metapackage
license  : GNU General Public License v2.0 or later (GPL-2.0-or-later) (OSI approved) https://spdx.org/licenses/GPL-2.0-or-later.html#licenseText
homepage :
source   : [git] https://github.com/drupal/core-recommended.git 1b87cf5dea633a66a1c4f22d635bc92c127071d9
dist     : [zip] https://api.github.com/repos/drupal/core-recommended/zipball/1b87cf5dea633a66a1c4f22d635bc92c127071d9 1b87cf5dea633a66a1c4f22d635bc92c127071d9
path     : /Applications/MAMP/htdocs/d8composer
names    : drupal/core-recommended

asm89/stack-cors 1.3.0
composer/semver 1.5.1
doctrine/annotations v1.4.0
doctrine/cache v1.6.2
doctrine/collections v1.4.0
doctrine/common v2.7.3
doctrine/inflector v1.2.0
doctrine/lexer 1.0.2
drupal/core 8.9.0
easyrdf/easyrdf 0.9.1
egulias/email-validator 2.1.17
guzzlehttp/guzzle 6.5.4
guzzlehttp/promises v1.3.1
guzzlehttp/psr7 1.6.1
laminas/laminas-diactoros 1.8.7p2
laminas/laminas-escaper 2.6.1
laminas/laminas-feed 2.12.2
laminas/laminas-stdlib 3.2.1
laminas/laminas-zendframework-bridge 1.0.4
masterminds/html5 2.3.0
paragonie/random_compat v9.99.99
pear/archive_tar 1.4.9
pear/console_getopt v1.4.3
pear/pear-core-minimal v1.10.10
pear/pear_exception v1.0.1
psr/container 1.0.0
psr/http-message 1.0.1
psr/log 1.1.3
ralouphie/getallheaders 3.0.3
stack/builder v1.0.5
symfony-cmf/routing 1.4.1
symfony/class-loader v3.4.41
symfony/console v3.4.41
symfony/debug v3.4.41
symfony/dependency-injection v3.4.41
symfony/event-dispatcher v3.4.41
symfony/http-foundation v3.4.41
symfony/http-kernel v3.4.41
symfony/polyfill-ctype v1.17.0
symfony/polyfill-iconv v1.17.0
symfony/polyfill-intl-idn v1.17.0
symfony/polyfill-mbstring v1.17.0
symfony/polyfill-php56 v1.17.0
symfony/polyfill-php70 v1.17.0
symfony/polyfill-php72 v1.17.0
symfony/polyfill-util v1.17.0
symfony/process v3.4.41
symfony/psr-http-message-bridge v1.1.2
symfony/routing v3.4.41
symfony/serializer v3.4.41
symfony/translation v3.4.41
symfony/validator v3.4.41
symfony/yaml v3.4.41
twig/twig v1.42.5
typo3/phar-stream-wrapper v3.1.4

webflo/drupal-core-strict *

I executed the command

composer prohibits drupal/core:8.9.1

drupal/core-recommended         8.9.0  requires  drupal/core (8.9.0)
webflo/drupal-core-require-dev  8.9.0  requires  drupal/core (8.9.0)

my composer.json file is

    "name": "drupal-composer/drupal-project",
    "description": "Project template for Drupal 8 projects with composer",
    "type": "project",
    "license": "GPL-2.0-or-later",
    "authors": [
            "name": "",
            "role": ""
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"
    "require": {
        "composer/installers": "^1.7",
        "cweagans/composer-patches": "^1.6",
        "drupal-composer/drupal-scaffold": "^2.2",
        "drupal/admin_toolbar": "^2.2",
        "drupal/backup_migrate": "^4.0",
        "drupal/console": "^1.0.2",
        "drupal/core-recommended": "^8.9",
        "drupal/ctools": "^3.2",
        "drupal/module_filter": "^3.1",
        "drupal/pathauto": "^1.5",
        "drupal/token": "^1.5",
        "drush/drush": "^9.0.0",
        "vlucas/phpdotenv": "^2.4",
        "webflo/drupal-finder": "^1.0.0",
        "webmozart/path-util": "^2.3",
        "zaporylie/composer-drupal-optimizations": "^1.0"
    "require-dev": {
        "webflo/drupal-core-require-dev": "^8.7.0"
    "conflict": {
        "drupal/drupal": "*"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "sort-packages": true
    "autoload": {
        "classmap": [
        "files": ["load.environment.php"]
    "scripts": {
        "drupal-scaffold": "DrupalComposer\\DrupalScaffold\\Plugin::scaffold",
        "pre-install-cmd": [
        "pre-update-cmd": [
        "post-install-cmd": [
        "post-update-cmd": [
    "extra": {
        "installer-paths": {
            "web/core": ["type:drupal-core"],
            "web/libraries/{$name}": ["type:drupal-library"],
            "web/modules/contrib/{$name}": ["type:drupal-module"],
            "web/profiles/contrib/{$name}": ["type:drupal-profile"],
            "web/themes/contrib/{$name}": ["type:drupal-theme"],
            "drush/contrib/{$name}": ["type:drupal-drush"]

I don't know how solve this issue. Thanks in advance for your help.

1 Answer 1


I'm pretty new with Composer, so take this advice with some skepticism.

I think the problem is you deleted drupal/core:

composer remove drupal/core

I looked in my composer.lock, and found drupal/core-recommended requires drupal/core. (I think maybe drupal/core-recommended is a metapackage that encompasses drupal/core.)

Look at the results of the "prohibits" command. "core-recommended" requires "core".

Hope that helps, Bill

  • Hello Bill,thank you very much for your message.
    – Paolo
    Jun 24, 2020 at 15:55
  • composer remove drupal/core was part of the Drupal documentation instructions to migrate from webflo/drupal-core-strict to drupal/core-recommended. Thanks to those commands I could successfully update my site from 8.7.8 to 8.9.0. I made a check on my composer.lock file and I didn't find drupal/core-recommended requires drupal/core. I suspect my problem is caused by webflo which, probably, is still active. Best regards. Paolo
    – Paolo
    Jun 24, 2020 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.