On my local site, I had updates for 2 modules and Drupal core. To update, I typed in composer update, which had worked for me previously just fine.

Composer indicated everything updated, although on the site itself, it shows Drupal core did not update. Also by typing in drush status, Composer shows the previous version of Drupal.

To see what is preventing the specific update, I type in: composer prohibits drupal/core:9.1.2 which gives me this:

drupal/core-recommended  9.0.10  requires          drupal/core (9.0.10)
drupal/core              9.1.2   requires          composer/semver (^3.0)
drupal/legacy-project    -       does not require  composer/semver (but 1.5.1 is installed)

To update any blocking dependencies with the core update, I then try the following (I used require instead of update as update didn't give me any results or useful into.):

composer require drupal/core:9.1.2 composer/semver --with-dependencies

This returns the following:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - drupal/core-recommended is locked to version 9.0.10 and an update of this package was not requested.
    - drupal/core-recommended 9.0.10 requires composer/semver 1.5.1 -> found composer/semver[1.5.1] but it conflicts with your root composer.json require (^3.2).
  Problem 2
    - drush/drush is locked to version dev-master and an update of this package was not requested.
    - drush/drush dev-master requires composer/semver ^1.4 -> found composer/semver[1.4.0, ..., 1.x-dev] but it conflicts with your root composer.json require (^3.2).

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

I read that Composer update problems are often related to abandoned composer templates or bad settings in composer.json. My composer files indicates at the top I am using drupal/legacy-project, not drupal/recommended. Although there is a line in my json file for "drupal/core-recommended": "^9". I'm not sure how to edit this file correctly.

I'm beating my head against the wall trying to figure out how to update Drupal core. Any recommendations much appreciated. Using Composer is very new to me.

** UPDATED with contents of composer.json file:

    "name": "drupal/legacy-project",
    "description": "Project template for Drupal 9 projects with composer following drupal/drupal layout",
    "type": "project",
    "license": "GPL-2.0-or-later",
    "homepage": "https://www.drupal.org/project/drupal",
    "support": {
        "docs": "https://www.drupal.org/docs/user_guide/en/index.html",
        "chat": "https://www.drupal.org/node/314178"
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"
    "require": {
        "composer/installers": "^1.9",
        "drupal/calendar": "^1.0@alpha",
        "drupal/core": "^9",
        "drupal/core-composer-scaffold": "^9",
        "drupal/core-project-message": "^9",
        "drupal/core-recommended": "^9",
        "drupal/core-vendor-hardening": "^9",
        "drupal/devel": "^4.0",
        "drupal/easy_breadcrumb": "^1.13",
        "drupal/pathauto": "^1.8",
        "drupal/redirect": "^1.6",
        "drupal/uswds_base": "^2.4",
        "drupal/views_slideshow": "^4.8",
        "drupal/views_templates": "^1.1",
        "drush/drush": "dev-master"
    "conflict": {
        "drupal/drupal": "*"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "sort-packages": true
    "extra": {
        "drupal-scaffold": {
            "locations": {
                "web-root": "./"
        "installer-paths": {
            "core": [
            "libraries/{$name}": [
            "modules/contrib/{$name}": [
            "profiles/contrib/{$name}": [
            "themes/contrib/{$name}": [
            "drush/Commands/contrib/{$name}": [
            "modules/custom/{$name}": [
            "themes/custom/{$name}": [
        "drupal-core-project-message": {
            "include-keys": [
            "post-create-project-cmd-message": [
                "<bg=blue;fg=white>                                                         </>",
                "<bg=blue;fg=white>  Congratulations, you’ve installed the Drupal codebase  </>",
                "<bg=blue;fg=white>  from the drupal/legacy-project template!               </>",
                "<bg=blue;fg=white>                                                         </>",
                "<bg=yellow;fg=black>Next steps</>:",
                "  * Install the site: https://www.drupal.org/docs/8/install",
                "  * Read the user guide: https://www.drupal.org/docs/user_guide/en/index.html",
                "  * Get support: https://www.drupal.org/support",
                "  * Get involved with the Drupal community:",
                "      https://www.drupal.org/getting-involved",
                "  * Remove the plugin that prints this message:",
                "      composer remove drupal/core-project-message"

  • Please add the contents of the composer.json to the question. If you want to update everything it is composer update --with-dependencies and depending on the template if you want to update core only it's either composer update drupal/core 'drupal/core-*' --with-all-dependencies or could also be composer update "drupal/core-*" --with-dependencies.
    – leymannx
    Jan 12, 2021 at 18:18
  • Maybe you have something like "drupal/core": "9.0 as 8.9.0", in your composer json? Pls post it here. Jan 13, 2021 at 9:54
  • In my experience do not add both drupal/core and drupal/core-recommended to your composer.json, either one or the other. core-recommended is depending on core, so updating recommended will also update core. OTOH updating core fails because it is not depending on recommended. I thought composer should work this out, but it very often doesn't for me.
    – Hudri
    Jan 14, 2021 at 13:49
  • IMHO there also is no need for drupal/core-vendor-hardening if you are using drupal/core-composer-scaffold. But you might still need to update/require drupal/core-composer-scaffold and drupal/core-recommended simultainiously.
    – Hudri
    Jan 14, 2021 at 13:50
  • Thanks. "drupal/core": "^9" wasn't there originally in the json file. Somewhere in my experimenting, it was added. I am going to delete that line and give it another go.
    – Fawn
    Jan 14, 2021 at 13:54


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.