Composer: Your Lock File Does Not Contain a Compatible Set of Packages in CI

By Daniel Zoghalchali·Latchkey

When composer install runs against a composer.lock whose pinned versions cannot satisfy the current platform (PHP version or extensions), Composer refuses to install and tells you the lock does not contain a compatible set, pointing you at composer update.

What this error means

A composer install (often --no-update/CI-style) aborts with "Your lock file does not contain a compatible set of packages. Please run composer update." It frequently follows a PHP version change in CI.

Your lock file does not contain a compatible set of packages. Please run
composer update.

  Problem 1
    - Root composer.json requires php >=8.2 but the locked acme/sdk 5.0.0
      requires php >=8.3, your php is 8.2.

Diagnose it: platform requirements and auth

Composer resolves against the PHP version and extensions actually present, so a lockfile that installs locally can be unsatisfiable on a runner with a different PHP build.

php -v && php -m | head -30
composer diagnose
composer check-platform-reqs

# install exactly what is locked, non-interactively
composer install --no-interaction --prefer-dist --no-progress

Common causes

The lock was generated against a different PHP/platform

The locked versions were resolved for a PHP or extension set that the current runner does not match, so the pinned set is not installable here.

composer.json changed without re-locking

A constraint was edited in composer.json but composer.lock was not regenerated, so the lock no longer reflects an installable resolution.

How to fix it

Re-lock for the target platform

Regenerate the lock so the pinned set matches the PHP/extensions you install on.

composer update --lock   # or a scoped composer update <package>
git add composer.lock

Install against the platform the lock targets

If the lock is correct, match the runner PHP to what it was resolved for instead of re-locking.

- uses: shivammathur/setup-php@v2
  with:
    php-version: '8.3'   # the version composer.lock was built for

Keep lock and platform in sync

1. Set config.platform.php to your production PHP and lock against it.
2. Commit composer.lock alongside every composer.json change.
3. Run composer validate in CI to catch lock/json drift.

How to prevent it

• Regenerate and commit composer.lock whenever constraints or PHP change.
• Pin config.platform.php so locking and installing use the same PHP.
• Run composer validate --strict in CI to catch stale locks early.

Frequently asked questions

Related guides

References

• Composer documentation
• GitHub Actions documentation