Drupal 8.2.7 to 8.3.0 update vender conflicts

[Aeotrin]

I am using composer-merge-plugin and trying to update from 8.2.7 to 8.3.0 using the following process

• Update composer.json with the new version of drupal
• Run the following command composer update drupal/core --with-dependencies

I am receiving the following error.

Your requirements could not be resolved to an installable set of packages. Problem 1

• Can only install one of: symfony/psr-http-message-bridge[1.0.x-dev, v0.2].
• Can only install one of: symfony/psr-http-message-bridge[v0.2, 1.0.x-dev].
• Can only install one of: symfony/psr-http-message-bridge[1.0.x-dev, v0.2].
• drupal/core 8.3.0 requires symfony/psr-http-message-bridge ^1.0 -> satisfiable by symfony/psr-http-message-bridge[1.0.x-dev].
• Installation request for drupal/core 8.3.0 -> satisfiable by drupal/core[8.3.0].
• Installation request for symfony/psr-http-message-bridge v0.2 -> satisfiable by symfony/psr-http-message-bridge[v0.2].

It seems like composer is looking at my current lock file (with version 0.2 for psr-http-message-bridge) instead of the merged version from the core/composer.json in drupal core.

I am not sure how this plugin works with lock files after looking through it a bit and was wondering if anyone could provide some insight if this is a higher composer issue or a merge-plugin issue

[Aeotrin]

It appears as though this plugin will merge the core composer.json file even though I am updating that project and I want it to use the new dependencies that would be coming down in the updated version.

[Aeotrin]

To reproduce: empty folder with the following composer.json

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/core": "8.2.7"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    }
}

Run composer update until everything is pulled down. update composer.json drupal/core entry to '8.3.0' Run any of the following

composer update
composer update --with-dependencies
composer update drupal/core
composer update drupal/core --with-dependencies
composer update drupal/core symfony/psr-http-message-bridge --with-dependencies

They all produce the error:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Can only install one of: symfony/psr-http-message-bridge[1.0.x-dev, v0.2].
    - Can only install one of: symfony/psr-http-message-bridge[v0.2, 1.0.x-dev].
    - Can only install one of: symfony/psr-http-message-bridge[1.0.x-dev, v0.2].
    - drupal/core 8.3.0 requires symfony/psr-http-message-bridge ^1.0 -> satisfiable by symfony/psr-http-message-bridge[1.0.x-dev].
    - Installation request for drupal/core 8.3.0 -> satisfiable by drupal/core[8.3.0].
    - Installation request for symfony/psr-http-message-bridge v0.2 -> satisfiable by symfony/psr-http-message-bridge[v0.2].

[bd808]

This looks to be a Drupal issue. Have you tried asking about it on their forums?

[Aeotrin]

Weird thing is, if I remove the merge plugin include, it all works fine. I debug the code and I can see it including the core/composer.json before that project is updated. I would expect it to use the updated versions of any projects being updated.

[bd808]

The errors you are seeing are caused by the newer version of Drupal requiring libraries of a different version than the libraries that are required by the older version which you are explicitly loading via the merge-plugin include configuration. You have handed the Composer dependency solver an unsolvable problem and it is telling you what the conflicting directives are.

I'm a bit confused about your usage of composer-merge-plugin to require the composer.json from drupal/core. Is this a normal and expected thing to do when installing Drupal? The composer.json file included in that package is exactly what Composer itself processes when you require the package in your root composer.json file. The old version from drupal/core v8.2.7 on your local disk and the new version from v8.3.0 pulled from the package repository express dependencies that are in conflict.

[Aeotrin]

So the merge plugin will merge in copies of both the current composer.json and the updated composer.json?

[bd808]

So the merge plugin will merge in copies of both the current composer.json and the updated composer.json?

Kind of. You have configured it to merge the contents of the core/composer.json file into whatever other configuration Composer receives from your root composer.json and the composer.json files of all transitively included packages.

I really can't see any reason at all to use composer-merge-plugin to process core/composer.json. That composer.json file is exactly the package manifest that is processed because of the "require": {"drupal/core": "8.2.7"}, configuration in your main composer.json. It appears that you have full control of the top level composer.json file for this project, so there is really no reason to want to use composer-merge-plugin. The plugin itself is intended to provide some measure of local control when using a project where the top level composer.json is under control of a third-party (e.g. https://github.com/wikimedia/mediawiki) and the deployer wants/needs to install additional packages for local installation.

[Aeotrin]

I see. Thanks for the info. I will test removing this, as I noticed some vendor dependencies are not installed without it, whether they are needed or not is what I will need to test.