Upgrading to 6.7.2 is failing

[ekrist1]

Bug description

Upgrading to version 6.7.2 is not working. Seems to be a bug in the latest tag?

How to reproduce

Install version 6.7.1

Composer update --> not updating to 6.7.2
composer require "statamic/cms 6.7.2"

Problem 1
- Root composer.json requires statamic/cms 6.7.2 (exact version match: 6.7.2 or 6.7.2.0), found statamic/cms[dev-make-deleting-filters-more-intentional, ..., dev-pinned-actions, v3.0.0-beta.1, ..., 3.4.x-dev, v4.0.0-alpha.1, ..., 4.x-dev, v5.0.0-alpha.1, ..., 5.x-dev, v6.0.0-alpha.1, ..., 6.x-dev] but it does not match the constraint.

Logs

Environment

Environment
Application Name: Statamic
Laravel Version: 12.55.1
PHP Version: 8.4.19
Composer Version: 2.9.5
Environment: local
Debug Mode: ENABLED
URL: fieldtype.test
Maintenance Mode: OFF
Timezone: UTC
Locale: en

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: NOT CACHED

Drivers
Broadcasting: log
Cache: file
Database: sqlite
Logs: stack / single
Mail: log
Queue: sync
Session: file

Storage
C:\kode\phpdev\fieldtype\public\storage: NOT LINKED

Statamic
Addons: 0
Sites: 1
Stache Watcher: Enabled (auto)
Static Caching: Disabled
Version: 6.7.1 PRO

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

[duncanmcclean]

Hmm, updating works fine for me. 6.7.2 is showing as expected on Packagist.

Maybe you need to clear your composer cache? composer clear-cache

[ekrist1]

It might be a wired caching issue somewhere, maybe at packagist.org. Strange thing is the other packages is being updated correctly. It might not be a Statamic Issue, so no further action is needed if not anyone else experience the same error.

I have tried composer clear-cache, removed composer.lock, tried another composer.char. The version is correct at packagist, but not when it is pulled down.

1. The live p2 endpoint is fresh
Direct fetch of:

https://repo.packagist.org/p2/statamic/cms.json

returns a body that:

contains v6.7.2
has length 351741
has SHA-256:
5a9f02c2b9c4a069232d850df9a8b09aff9318763522d011f3577be9486e781f

and response headers include:

Last-Modified: Tue, 24 Mar 2026 16:46:25 GMT
no ETag
CDN-Cache: HIT
2. Composer’s provider cache body is different
Composer’s cached provider file:

[provider-statamic~cms.json](vscode-file://vscode-app/c:/Users/AppData/Local/Programs/Microsoft%20VS%20Code/07ff9d6178/resources/app/out/vs/code/electron-browser/workbench/workbench.html)

contains:

no v6.7.2
does contain v6.7.1
length 351274
SHA-256:
517a58c512bec20d98c28af31e34b6e4c60096dbef33db4e13e5090535a7cf03

So this is not a parsing illusion — the cached bytes are genuinely different.

3. A brand-new Composer cache still gets the stale body
This is the big one.

I ran Composer with a completely fresh COMPOSER_CACHE_DIR.

Result:

Composer created a fresh provider-statamic~cms.json
that still did not contain v6.7.2
and it had the same stale length: 351274
So this is not just leftover local cache on disk.

4. Conditional requests are active and based on Last-Modified
Manual conditional GET tests against the live endpoint showed:

If-Modified-Since: Tue, 24 Mar 2026 16:46:25 GMT → 304
If-Modified-Since: Tue, 24 Mar 2026 16:46:24 GMT → 200
That means the endpoint is validating based on Last-Modified exactly as expected.

What that means
The strongest interpretation is:

there are at least two different bodies in play for the same metadata URL
the “fresh/live” one includes v6.7.2
the “Composer-observed” one does not
and once Composer gets the stale one, later conditional requests can preserve it via 304 Not Modified

[comdraft]

Having the same Problem here!

[ekrist1]

Not sure if it is a packagist problem or if there is somehow linked to the 6.7.3 tag. Did you find any clues why this is happening?

\.config\herd\bin\php84\php.exe C:\code\composer(1).phar show statamic/cms --all
No composer.json found in the current directory, showing available packages from packagist.org
name     : statamic/cms
descrip. : The Statamic CMS Core Package
keywords : cms, laravel, flat file, statamic
versions : dev-master, 6.x-dev, v6.7.1, v6.7.0, v6.6.3, v6.6.2, v6.6.1, v6.6.0, v6.5.0, v6.4.1, v6.4.0, v6.3.3, v6.3.2, v6.3.1, v6.3.0, v6.2.5, v6.2.4, v6.2.3, v6.2.2, v6.2.1, v6.2.0, v6.1.0, v6.0.0, v6.0.0-beta.6, v6.0.0-beta.5, v6.0.0-beta.4, v6.0.0-beta.3, v6.0.0-beta.2, v6.0.0-beta.1, v6.0.0-alpha.21, v6.0.0-alpha.20, v6.0.0-alpha.19, v6.0.0-alpha.18, v6.0.0-alpha.17, v6.0.0-alpha.16, v6.0.0-alpha.15, v6.0.0-alpha.14, v6.0.0-alpha.13, v6.0.0-alpha.12, v6.0.0-alpha.11, v6.0.0-alpha.10, v6.0.0-alpha.9, v6.0.0-alpha.8, v6.0.0-alpha.7, v6.0.0-alpha.6, v6.0.0-alpha.5, v6.0.0-alpha.4, v6.0.0-alpha.3, v6.0.0-alpha.2, v6.0.0-alpha.1, 5.x-dev, v5.73.16, v5.73.15, v5.73.14, v5.73.13, v5.73.12, v5.73.11, v5.73.10, v5.73.9, v5.73.8, v5.73.7, v5.73.6, v5.73.5, v5.73.4, v5.73.3, v5.73.2, v5.73.1, v5.73.0, v5.72.0, v5.71.0, v5.70.0, v5.69.0, v5.68.0, v5.67.0, v5.66.0, v5.65.2, v5.65.1, v5.65.0, v5.64.0, v5.63.0, v5.62.0, v5.61.0, v5.60.0, v5.59.0, v5.58.1, v5.58.0, v5.57.0, v5.56.0, v5.55.0, v5.54.0, v5.53.1, v5.53.0, v5.52.0, v5.51.0, v5.50.0, v5.49.1, v5.49.0, v5.48.1, v5.48.0, v5.47.0, v5.46.1, v5.46.0, v5.45.2, v5.45.1, v5.45.0, v5.44.0, v5.43.2, v5.43.1, v5.43.0, v5.42.1, v5.42.0, v5.41.0, v5.40.0, v5.39.0, v5.38.1, v5.38.0, v5.37.0, v5.36.0, v5.35.0, v5.34.0, v5.33.1, v5.33.0, v5.32.0, v5.31.0, v5.30.0, v5.29.0, v5.28.0, v5.27.0, v5.26.0, v5.25.0, v5.24.0, v5.23.0, v5.22.1, v5.22.0, v5.21.0, v5.20.0, v5.19.0, v5.18.0, v5.17.1, v5.17.0, v5.16.0, v5.15.0, v5.14.0, v5.13.0, v5.12.0, v5.11.0, v5.10.0, v5.9.0, v5.8.0, v5.7.3, v5.7.2, v5.7.1, v5.7.0, v5.6.2, v5.6.1, v5.6.0, v5.5.0, v5.4.0, v5.3.0, v5.2.0, v5.1.0, v5.0.2, v5.0.1, v5.0.0, v5.0.0-beta.4, v5.0.0-beta.3, v5.0.0-beta.2, v5.0.0-beta.1, v5.0.0-alpha.6, v5.0.0-alpha.5, v5.0.0-alpha.4, v5.0.0-alpha.3, v5.0.0-alpha.2, v5.0.0-alpha.1, 4.x-dev, v4.58.3, v4.58.2, v4.58.1, v4.58.0, v4.57.3, v4.57.2, v4.57.1, v4.57.0, v4.56.1, v4.56.0, v4.55.0, v4.54.0, v4.53.2, v4.53.1, v4.53.0, v4.52.0, v4.51.0, v4.50.0, v4.49.0, v4.48.0, v4.47.0, v4.46.0, v4.45.0, v4.44.0, v4.43.0, v4.42.1, v4.42.0, v4.41.0, v4.40.0, v4.39.0, v4.38.0, v4.37.0, v4.36.0, v4.35.0, v4.34.0, v4.33.0, v4.32.0, v4.31.0, v4.30.0, v4.29.0, v4.28.0, v4.27.0, v4.26.1, v4.26.0, v4.25.0, v4.24.0, v4.23.2, v4.23.1, v4.23.0, v4.22.0, v4.21.0, v4.20.0, v4.19.0, v4.18.0, v4.17.0, v4.16.0, v4.15.0, v4.14.0, v4.13.2, v4.13.1, v4.13.0, v4.12.0, v4.11.0, v4.10.2, v4.10.1, v4.10.0, v4.9.2, v4.9.1, v4.9.0, v4.8.0, v4.7.0, v4.6.0, v4.5.0, v4.4.0, v4.3.0, v4.2.0, v4.1.3, v4.1.2, v4.1.1, v4.1.0, v4.0.0, v4.0.0-beta.4, v4.0.0-beta.3, v4.0.0-beta.2, v4.0.0-beta.1, v4.0.0-alpha.5, v4.0.0-alpha.4, v4.0.0-alpha.3, v4.0.0-alpha.2, v4.0.0-alpha.1, 3.4.x-dev, v3.4.17, v3.4.16, v3.4.15, v3.4.14, v3.4.13, v3.4.12, v3.4.11, v3.4.10, v3.4.9, v3.4.8, v3.4.7, v3.4.6, v3.4.5, v3.4.4, v3.4.3, v3.4.2, v3.4.1, v3.4.0, 3.3.x-dev, v3.3.68, v3.3.67, v3.3.66, v3.3.65, v3.3.64, v3.3.63, v3.3.62, v3.3.61, v3.3.60, v3.3.59, v3.3.58, v3.3.57, v3.3.56, v3.3.55, v3.3.54, v3.3.53, v3.3.52, v3.3.51, v3.3.50, v3.3.49, v3.3.48, v3.3.47, v3.3.46, v3.3.45, v3.3.44, v3.3.43, v3.3.42, v3.3.41, v3.3.40, v3.3.39, v3.3.38, v3.3.37, v3.3.36, v3.3.35, v3.3.34, v3.3.33, v3.3.32, v3.3.31, v3.3.30, v3.3.29, v3.3.28, v3.3.27, v3.3.26, v3.3.25, v3.3.24, v3.3.23, v3.3.22, v3.3.21, v3.3.20, v3.3.19, v3.3.18, v3.3.17, v3.3.16, v3.3.15, v3.3.14, v3.3.13, v3.3.12, v3.3.11, v3.3.10, v3.3.9, v3.3.8, v3.3.7, v3.3.6, v3.3.5, v3.3.4, v3.3.3, v3.3.2, v3.3.1, v3.3.0, v3.3.0-beta.7, v3.3.0-beta.6, v3.3.0-beta.5, v3.3.0-beta.4, v3.3.0-beta.3, v3.3.0-beta.2, v3.3.0-beta.1, 3.2.x-dev, v3.2.39, v3.2.38, v3.2.37, v3.2.36, v3.2.35, v3.2.34, v3.2.33, v3.2.32, v3.2.31, v3.2.30, v3.2.29, v3.2.28, v3.2.27, v3.2.26, v3.2.25, v3.2.24, v3.2.23, v3.2.22, v3.2.21, v3.2.20, v3.2.19, v3.2.18, v3.2.17, v3.2.16, v3.2.15, v3.2.14, v3.2.13, v3.2.12, v3.2.11, v3.2.10, v3.2.9, v3.2.8, v3.2.7, v3.2.6, v3.2.5, v3.2.4, v3.2.3, v3.2.2, v3.2.1, v3.2.0, v3.2.0-beta.1, 3.1.x-dev, v3.1.35, v3.1.34, v3.1.33, v3.1.32, v3.1.31, v3.1.30, v3.1.29, v3.1.28, v3.1.27, v3.1.26, v3.1.25, v3.1.24, v3.1.23, v3.1.22, v3.1.21, v3.1.20, v3.1.19, v3.1.18, v3.1.17, v3.1.16, v3.1.15, v3.1.14, v3.1.13, v3.1.12, v3.1.11, v3.1.10, v3.1.9, v3.1.8, v3.1.7, v3.1.6, v3.1.5, v3.1.4, v3.1.3, v3.1.2, v3.1.1, v3.1.0, v3.1.0-beta.3, v3.1.0-beta.2, v3.1.0-beta.1, v3.1.0-alpha.4, v3.1.0-alpha.3, v3.1.0-alpha.2, v3.1.0-alpha.1, 3.0.x-dev, v3.0.49, v3.0.48, v3.0.47, v3.0.46, v3.0.45, v3.0.44, v3.0.43, v3.0.42, v3.0.41, v3.0.40, v3.0.39, v3.0.38, v3.0.37, v3.0.36.1, v3.0.36, v3.0.35.1, v3.0.35, v3.0.34, v3.0.33, v3.0.32, v3.0.31, v3.0.30, v3.0.29, v3.0.28, v3.0.27, v3.0.26, v3.0.25, v3.0.24, v3.0.23, v3.0.22, v3.0.21, v3.0.20, v3.0.19, v3.0.18, v3.0.17, v3.0.16, v3.0.15, v3.0.14, v3.0.13, v3.0.12, v3.0.11, v3.0.10, v3.0.9, v3.0.8, v3.0.7, v3.0.6, v3.0.5, v3.0.4, v3.0.3, v3.0.2, v3.0.1, v3.0.0, v3.0.0-beta.46, v3.0.0-beta.45, v3.0.0-beta.44, v3.0.0-beta.43, v3.0.0-beta.42, v3.0.0-beta.41, v3.0.0-beta.40, v3.0.0-beta.39, v3.0.0-beta.38, v3.0.0-beta.37, v3.0.0-beta.36, v3.0.0-beta.35, v3.0.0-beta.34, v3.0.0-beta.33, v3.0.0-beta.32, v3.0.0-beta.31, v3.0.0-beta.30, v3.0.0-beta.29, v3.0.0-beta.28, v3.0.0-beta.27, v3.0.0-beta.26, v3.0.0-beta.25, v3.0.0-beta.24, v3.0.0-beta.23, v3.0.0-beta.22, v3.0.0-beta.21, v3.0.0-beta.20, v3.0.0-beta.19, v3.0.0-beta.18, v3.0.0-beta.17, v3.0.0-beta.16, v3.0.0-beta.15, v3.0.0-beta.14, v3.0.0-beta.13, v3.0.0-beta.12, v3.0.0-beta.11, v3.0.0-beta.10, v3.0.0-beta.9, v3.0.0-beta.8, v3.0.0-beta.7, v3.0.0-beta.6, v3.0.0-beta.5, v3.0.0-beta.4, v3.0.0-beta.3, v3.0.0-beta.2, v3.0.0-beta.1, dev-asset-tag-filtering-conditions, dev-mastodon-icon-stroke, dev-empty-globals, dev-ensuring-fields-for-fieldsets, dev-asset-reference-viewer, dev-fix-field-actions, dev-publish-container-storybook, dev-localizable-asset-meta-data, dev-multisite-dropdown-improvements, dev-collaboration-addon-support, dev-replicator-add-set-interface-optimisations, dev-copilot/sub-pr-14045, dev-replicator-inside-custom-fieldtypes, dev-dependabot/npm_and_yarn/storybook-10.2.13, dev-pinned-actions, dev-fix-social-login-icon-opacity, dev-cp-searchables, dev-nav-preferences-first-section, dev-fix/default-values-after-saving, dev-experiment/performance, dev-feature/is-dirty-is-clean, dev-deferred-all-augmentation, dev-image-manipulation, dev-feature/field-actions, dev-starter-kit-module-folders, dev-localizable-assets, dev-now-dates, dev-frontend-form-grid, dev-assets-customizable-columns, dev-empty-dashboard, dev-markdown-slash-commands, dev-user-settings-tab, dev-stacks-to-drawers, dev-lazy-load-actions, dev-term-revisions-error, dev-dictionary-label-escaping, dev-translator-symfony-console, dev-timezones, dev-set-picker-position, dev-combobox-2-0, dev-scrollable-dropdowns, dev-localized-nested-fields, dev-two-factor-setup-modal, dev-bard-focus-improvements, dev-reset-password-form, dev-pull-header-above-architectural-lines, dev-improve-switching-site-flickers, dev-correct-bard-full-screen-width, dev-duplicate-edit-fieldset-translation, dev-read-only-nested-fields, dev-moment-translation, dev-antlers-config, dev-markdown-fieldtype-endpoint, dev-improve-container-breapoint-for-assets-fieldtype, dev-graphql-auth, dev-revisions-date-field, dev-make-deleting-filters-more-intentional, dev-update-set-preview-images, dev-text-component, dev-disable-two-factor, dev-disabled-group-fields, dev-role-group-fieldtypes, dev-localize-middleware-translator, dev-fieldset-sections, dev-is-external-url-backslashes-6.x, dev-fix-form-external-redirect, dev-files-field-rules, dev-relationship-fieldtype-authorization, dev-revisions-authorization, dev-svg-csp, dev-feature/form-metrics
type     : library
license  : proprietary
homepage :
source   : [git] https://github.com/statamic/cms.git 4632fcaf0f8822e98e33059bbc75eb4ac808b1df
dist     : [zip] https://api.github.com/repos/statamic/cms/zipball/4632fcaf0f8822e98e33059bbc75eb4ac808b1df 4632fcaf0f8822e98e33059bbc75eb4ac808b1df
names    : statamic/cms

support
issues : https://github.com/statamic/cms/issues
source : https://github.com/statamic/cms/tree/6.x

autoload
files
psr-4
Statamic\ => src/
exclude-from-classmap

requires
ext-json *
ajthinking/archetype ^1.0.3 || ^2.0
bacon/bacon-qr-code ^3.0
composer/semver ^3.4
guzzlehttp/guzzle ^6.3 || ^7.0
inertiajs/inertia-laravel ^2.0
james-heinrich/getid3 ^1.9.21
laravel/prompts ^0.3.0
league/commonmark ^2.2
league/csv ^9.0
league/glide ^3.0
maennchen/zipstream-php ^3.1
michelf/php-smartypants ^1.8.1
nesbot/carbon ^3.0
pixelfear/composer-dist-plugin ^0.1.4
rhukster/dom-sanitizer ^1.0.7
spatie/blink ^1.3
spatie/error-solutions ^1.0 || ^2.0
statamic/stringy ^3.1.2
ueberdosis/tiptap-php ^2.0
voku/portable-ascii ^2.0.2
web-auth/webauthn-lib ~5.2.0
wilderborn/partyline ^1.0
pragmarx/google2fa ^8.0 || ^9.0
laravel/framework ^12.40.0 || ^13.0
rebing/graphql-laravel ^9.15
stillat/blade-parser ^2.1
symfony/http-foundation ^7.3.7 || ^8.0
symfony/lock ^7.0.3 || ^8.0
symfony/var-exporter ^7.0.3 || ^8.0
symfony/yaml ^7.0.3 || ^8.0

requires (dev)
algolia/algoliasearch-client-php ^4.32
doctrine/dbal ^3.6
fakerphp/faker ~1.10
google/cloud-translate ^1.6
laravel/pint 1.16.0
mockery/mockery ^1.6.10
orchestra/testbench ^10.8 || ^11.0
phpunit/phpunit ^11.5.3
spatie/laravel-ray ^1.43.6

suggests
algolia/algoliasearch-client-php Required to use Algolia search driver (^4.32)

conflicts
algolia/algoliasearch-client-php <4.32

[jasonvarga]

All signs seem to point to some issue at packagist's CDN.

I hit the update button on the statamic/cms packagist page, so maybe that'll trigger something to be refreshed. But I think it might just be a case of... wait a bit.

Try composer-clear cache and wait a little. Rinse and repeat.

You could also try using a VPN to hit a different CDN edge server, or use a different DNS resolver on your computer temporarily. e.g. 1.1.1.1 for Cloudflare or 8.8.8.8 for Google. (But switch back after).

[jasonvarga]

We've also just released 6.7.3 so please let us know if that works or not.

[comdraft]

Works!