Workaround: guzzlehttp/psr7 update to allow composer updates
15 June 2026 at 15:26
If you ran into the
Your requirements could not be resolved to an installable set of packages.
error message while running composer update today, see this issue:
https://www.drupal.org/project/drupal/issues/3599842
In brief, quoting the the issue:
While these were fixed a few weeks ago (see https://github.com/advisories/GHSA-hq7v-mx3g-29hw), we can see the composer datasource was only registered with the vulnerabilities on June 11th.
and
You can temporarily fetch the 2.11.0 version of
guzzlehttp/psrand alias it to 2.8.1 with this:
composer require "guzzlehttp/psr7:2.11.0 as 2.8.1"
Revert this once a new Drupal core is released by deleting theguzzlehttp/psr7": "2.11.0 as 2.8.1",line in composer.json, and then updating Drupal core.
[link] [comments]