Image styles are served by Drupal when they are first created, but then saved on disk. So, the are served up by your webserver directly aferwards. That makes this more of a Varnish question, but I am leaving this open as it is a Drupal related quirk/issue with how image styles work and Varnish.

@greggles Yeah, updated the var name in the code.

hook_init() doesn't run on cached pages, but hook_boot() runs on all requests that get routed to Drupal.

What is the output of composer why-not drupal/core:8.7.1 ?

@arnoldbird composer update drupal/core webflo/drupal-core-strict composer/installers --with-dependencies should do the trick.

Very odd. How about composer why drupal/core:8.2.x-dev? Since it isn't in your main composer.json, drupal/core:8.2.x-dev is somewhere in the dependency tree. You can also read the lockfile and search for that and see what section / package is listing it.

Temporarily removing drush and drupal console can also help.

Can you show what composer why-not drupal/core:8.6.13 lists? This may narrow the problem down better. As a side note, I suspect there is a Symfony related dependency problem. Personally I always use webflo/drupal-core-strict, pinned top the same version as core, which tends to prevent dependency problems.

@arnoldbird The number of dependencies that core brings in can expose bugs and other quirks in composer.

Keep i mind that Drupal 8.4.2 predates SA-CORE-2018-002 and SA-CORE-2018-004. If your site is public, there is a chance it is compromised.

What version are you upgrading from?

@obrassard What is the field type for that input?

Can you try editing composer.json and adding "webflo/drupal-core-strict": "8.6.13" as a requirement, and then doing composer update? If this works, I'll writeup a better answer about what may be going on.