With Drupal 8, arrives Composer as the standard for dependencies management on our projects. This implies that our processes will need to be adapted to follow this new dependency management organization, like modules installation or Core upgrades.
In this case we will talk about components upgrades, focused on how “composer prohibits” command can help us when the upgrade process doesn’t work fine. Here we will use Drupal as an example to explain how this command work, but the solution works on every project with composer as dependency manager.
Let’s assume that we have a Drupal project with 8.5 Core version, and we'd like to upgrade to Drupal 8.6. What we would do is to execute the following:
composer update drupal/core --with-dependencies
When we execute this, Composer will upgrade dependencies and needed packages, but when Composer finished, it may happen that drupal/core is still in 8.5.x version. In this moment, many people fall back to force the upgrade with “composer update”. That can bring us to many headaches, because the update command will upgrade every dependency of the project.
It's on that moment when “composer prohibits” can help us. To check why Drupal core doesn’t upgrade, we will execute the following command:
composer prohibits drupal/core:8.6.2
Composer will check what package is blocking Drupal core 8.6.2 upgrade. The command give us a list of packages that are holding back the upgrade, like the following:
webflo/drupal-core-require-dev 8.5.8 requires drupal/core (8.5.8)
As for this example, the command is telling us that “webflo/drupal-core-require-dev” needs 8.5.8 core version to work, and is blocking the core upgrade. To solve the problem, we should include this package when executing the update command:
composer update drupal/core webflo/drupal-core-require-dev --with-dependencies
Now Composer will upgrade both packages, drupal core and webflo package, and Drupal will be upgraded normally.
The composer prohibits command can be used to check if, for example, we like to upgrade some system requirement, like php version:
composer prohibits php:7.2
This will tell us which packages don’t support the new php version.
As we mentioned earlier, this isn’t an Drupal exclusive solution, so we can apply this fantastic command to any project that has Composer as dependency manager.