Why is Composer installing an old version when it isn't specified?

Question

When I do:

composer require deployer/deployer

I get the following output:

Info from https://repo.packagist.org: #StandWithUkraine
Using version ^4.3 for deployer/deployer
./composer.json has been updated
Running composer update deployer/deployer
Loading composer repositories with package information
Info from https://repo.packagist.org: #StandWithUkraine
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - deployer/deployer[v4.3.0, ..., 4.x-dev] require monolog/monolog ^1.21 -> found monolog/monolog[1.21
.0, ..., 1.x-dev] but the package is fixed to 2.3.5 (lock file version) by a partial update and that vers
ion does not match. Make sure you list it as an argument for the update command.
    - Root composer.json requires deployer/deployer ^4.3 -> satisfiable by deployer/deployer[v4.3.0, ...,
 4.x-dev].

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

Installation failed, reverting ./composer.json and ./composer.lock to their original content.

deployer/deployer is not in the project's composer.json or composer.lock, so what could possibly be requring the relatively ancient version of the package that doesn't seem to be supported by any other package in my Laravel 8 project?

Answer 1

Since you're using PHP 8, 4.3 is the latest version of deployer/deployer that composer has determined to be compatible with your PHP version and minimum stability requirement.

• v7 has no stable release yet, but it is the version you need to use with PHP 8.
  You can use the release candidate with composer require deployer/deployer:^7.0@RC, or if you set "minimum-stability": "RC" in your composer.json, then composer require deployer/deployer should install it.

• v6 requires "php": "^7.2".
  I believe this is equivalent to >=7.2 <8.0.0, according to the composer manual.

• v5 requires "php": "~7.0" (meaning >=7.0 <8.0)

• v4 requires "php": ">=5.6.0" (meaning anything above 5.6.0)
  This old version is the one you're getting because it's the only version composer can attempt to install due to the constraints I mentioned above. I don't know if it really is compatible with PHP 8, but I doubt it.