Updating core to 8.9.6 fails

Question

I'v installed Drupal 8 by composer. Everything worked fine, but when I tried to update core from 8.9.1 to 8.9.5 in ended up in 8.9.4.

Today I tried to update from 8.9.4. to 8.9.6 by changing composer.json to demand v 8.9.6 at least.

The result was following error message:

Your requirements could not be resolved to an installable set of packages. Problem 1

• Installation request for symfony/http-kernel (locked at v3.4.41) -> satisfiable by symfony/http-kernel[v3.4.41]. > - drupal/core-recommended 8.9.6 requires symfony/http-kernel v3.4.44 -> satisfiable by symfony/http-kernel[v3.4.44]. > - drupal/core-recommended 8.9.x-dev requires symfony/http-kernel v3.4.44 -> satisfiable by symfony/http-kernel[v3.4.44]. > - Conclusion: don't install symfony/http-kernel v3.4.44 > - Installation request for drupal/core-recommended ^8.9.6 -> satisfiable by drupal/core-recommended[8.9.6, 8.9.x-dev].

I'm stuck, since I don't know what locks symphony/http-kernel to v3.4.41.

I'm still pretty new with composer and would be glad if anybody could help me. Thanks a lot.

EDIT 1

{
"name": "drupal/legacy-project",
"description": "Project template for Drupal 8 projects with composer following drupal/drupal layout",
"type": "project",
"license": "GPL-2.0-or-later",
"homepage": "https://www.drupal.org/project/drupal",
"support": {
    "docs": "https://www.drupal.org/docs/user_guide/en/index.html",
    "chat": "https://www.drupal.org/node/314178"
},
"repositories": [
    {
        "type": "composer",
        "url": "https://packages.drupal.org/8"
    }
],
"require": {
    "civicrm/civicrm-asset-plugin": "~1.0.0",
    "civicrm/civicrm-core": "~5.28",
    "civicrm/civicrm-drupal-8": "~5.28",
    "civicrm/civicrm-packages": "~5.28",
    "composer/installers": "^1.2",
    "drupal/admin_toolbar": "^2.2",
    "drupal/antibot": "^1.4",
    "drupal/at_tools": "^3.2",
    "drupal/barrio": "1.x-dev",
    "drupal/captcha": "^1.0",
    "drupal/clever_theme_switcher": "^3.0",
    "drupal/colorbox": "^1.4",
    "drupal/commerce": "^2.17",
    "drupal/commerce_shipping": "^2.0@RC",
    "drupal/core-composer-scaffold": "^8.9.6",
    "drupal/core-project-message": "^8.9.6",
    "drupal/core-recommended": "^8.9.6",
    "drupal/core-vendor-hardening": "^8.",
    "drupal/ctools": "^3.4",
    "drupal/editor_advanced_link": "^1.6",
    "drupal/editor_file": "^1.4",
    "drupal/entity_browser": "^2.4",
    "drupal/hotkeys_for_save": "^1.0",
    "drupal/imce": "^2.3",
    "drupal/layout_builder_kit": "^1.0@beta",
    "drupal/layout_builder_modal": "^1.0",
    "drupal/linkit": "^4.3",
    "drupal/media_library_theme_reset": "^1.0@beta",
    "drupal/menu_block": "^1.5",
    "drupal/menu_item_role_access": "^2.0",
    "drupal/mobile_device_detection": "^3.2",
    "drupal/module_filter": "^3.1",
    "drupal/nagios": "^1.9",
    "drupal/pathauto": "^1.6",
    "drupal/permissions_by_term": "^2.18",
    "drupal/pixture_reloaded": "^3.0",
    "drupal/printable": "^1.1",
    "drupal/quick_node_clone": "^1.12",
    "drupal/redirect": "^1.5",
    "drupal/superfish": "^1.3",
    "drupal/swiftmailer": "^2.0@beta",
    "drupal/token": "^1.6",
    "drupal/upgrade_status": "^2.0",
    "drupal/views_conditional": "^1.0",
    "drupal/views_slideshow": "^4.7",
    "drupal/webform": "^5.9",
    "drupal/webform_civicrm": "^5.0@beta",
    "drupal/xmlsitemap": "^1.0@RC",
    "wikimedia/composer-merge-plugin": "^1.4"
},
"conflict": {
    "drupal/drupal": "*"
},
"minimum-stability": "dev",
"prefer-stable": true,
"config": {
    "sort-packages": true
},
"extra": {
    "drupal-scaffold": {
        "locations": {
            "web-root": "./"
        }
    },
    "installer-paths": {
        "core": [
            "type:drupal-core"
        ],
        "libraries/{$name}": [
            "type:drupal-library"
        ],
        "modules/contrib/{$name}": [
            "type:drupal-module"
        ],
        "profiles/contrib/{$name}": [
            "type:drupal-profile"
        ],
        "themes/contrib/{$name}": [
            "type:drupal-theme"
        ],
        "drush/Commands/contrib/{$name}": [
            "type:drupal-drush"
        ],
        "modules/custom/{$name}": [
            "type:drupal-custom-module"
        ],
        "themes/custom/{$name}": [
            "type:drupal-custom-theme"
        ]
    },
    "merge-plugin": {
        "include": [
            "modules/contrib/webform/composer.libraries.json"
        ]
    },
    "drupal-core-project-message": {
        "include-keys": [
            "homepage",
            "support"
        ],
        "post-create-project-cmd-message": [
            "<bg=blue;fg=white>                                                         </>",
            "<bg=blue;fg=white>  Congratulations, you’ve installed the Drupal codebase  </>",
            "<bg=blue;fg=white>  from the drupal/legacy-project template!               </>",
            "<bg=blue;fg=white>                                                         </>",
            "",
            "<bg=yellow;fg=black>Next steps</>:",
            "  * Install the site: https://www.drupal.org/docs/8/install",
            "  * Read the user guide: https://www.drupal.org/docs/user_guide/en/index.html",
            "  * Get support: https://www.drupal.org/support",
            "  * Get involved with the Drupal community:",
            "      https://www.drupal.org/getting-involved",
            "  * Remove the plugin that prints this message:",
            "      composer remove drupal/core-project-message"
        ]
    }
}

}

My update command was

composer u drupal/core* --with-dependencies

Answer 1

I tried an update with composer u. This updated my CiviCRM packages and their dependencies and thus removed the dependency conflict described above.

I had removed drupal/core-vendor-hardening as was suggested in @leymannx's answer (but kept the vendor/ directory). That broke the installation and produced a fatal error running composer u. After restoring it everything worked fine for me. Thanks for everyone who helped.