title: Problem with roave/security-advisories when update symfony 4 to 5
body: <p>I'm trying to update my Symfony 4.4.19 to Symfony 5.x but i've got two conflicts who are blocking the process:
  symfony/monolog-bundle and roave/security-advisories</p>
  <p>I'm running method <code>composer update &quot;symfony/*&quot; --with-all-dependencies</code>
  In Symfony documentation about <a href="https://symfony.com/doc/current/setup/upgrade_major.html#update-to-the-new-major-version-via-composer" rel="nofollow noreferrer">upgrading</a>, it is clearly specified that &quot;<em>A few libraries starting with symfony/ follow their own versioning scheme. You do not need to update these versions: you can upgrade them independently whenever you want</em>&quot;  and the example is...symfony/monolog-bundle</p>
  <pre class="lang-sh prettyprint-override"><code>Updating dependencies
    Problem 1
      - Root composer.json requires symfony/monolog-bundle ^3.6 -&gt; satisfiable by symfony/monolog-bundle[v3.6.0].
      - symfony/monolog-bundle v3.6.0 requires symfony/http-kernel ~3.4 || ~4.0 || ^5.0 -&gt; satisfiable by symfony/http-kernel[v5.0.0, ..., v5.0.11].
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.11.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.10.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.9.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.8.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.7.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.6.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.5.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.4.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.3.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.2.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.1.
      - roave/security-advisories dev-latest conflicts with symfony/http-kernel v5.0.0.
      - roave/security-advisories is locked to version dev-latest and an update of this package was not requested.
  </code></pre>
  <p>Here's my composer.json where i've replaced all 4.4 to 5.0 :</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;type&quot;: &quot;project&quot;,
      &quot;version&quot;: &quot;1.2.0&quot;,
      &quot;license&quot;: &quot;proprietary&quot;,
      &quot;require&quot;: {
          &quot;php&quot;: &quot;^7.4.0&quot;,
          &quot;ext-ctype&quot;: &quot;*&quot;,
          &quot;ext-iconv&quot;: &quot;*&quot;,
          &quot;ext-intl&quot;: &quot;*&quot;,
          &quot;ext-json&quot;: &quot;*&quot;,
          &quot;abraham/twitteroauth&quot;: &quot;^1.1&quot;,
          &quot;excelwebzone/recaptcha-bundle&quot;: &quot;^1.5&quot;,
          &quot;facebook/graph-sdk&quot;: &quot;^5.7&quot;,
          &quot;friendsofsymfony/rest-bundle&quot;: &quot;^3.0&quot;,
          &quot;gesdinet/jwt-refresh-token-bundle&quot;: &quot;^0.9.1&quot;,
          &quot;hamhamfonfon/astrobin-ws&quot;: &quot;^2.0&quot;,
          &quot;jms/serializer-bundle&quot;: &quot;^3.3&quot;,
          &quot;lexik/jwt-authentication-bundle&quot;: &quot;^2.6&quot;,
          &quot;ruflin/elastica&quot;: &quot;^6.0&quot;,
          &quot;sensio/framework-extra-bundle&quot;: &quot;^5.2&quot;,
          &quot;symfony/asset&quot;: &quot;^5.0&quot;,
          &quot;symfony/console&quot;: &quot;^5.0&quot;,
          &quot;symfony/dotenv&quot;: &quot;^5.0&quot;,
          &quot;symfony/expression-language&quot;: &quot;^5.0&quot;,
          &quot;symfony/flex&quot;: &quot;^1.11&quot;,
          &quot;symfony/form&quot;: &quot;^5.0&quot;,
          &quot;symfony/framework-bundle&quot;: &quot;^5.0&quot;,
          &quot;symfony/google-mailer&quot;: &quot;5.0&quot;,
          &quot;symfony/http-client&quot;: &quot;5.0&quot;,
          &quot;symfony/intl&quot;: &quot;^5.0&quot;,
          &quot;symfony/mailer&quot;: &quot;5.0.*&quot;,
          &quot;symfony/monolog-bundle&quot;: &quot;^3.6&quot;,
          &quot;symfony/orm-pack&quot;: &quot;^1.2&quot;,
          &quot;symfony/process&quot;: &quot;5.0.*&quot;,
          &quot;symfony/requirements-checker&quot;: &quot;^1.1&quot;,
          &quot;symfony/security-bundle&quot;: &quot;^5.0&quot;,
          &quot;symfony/serializer&quot;: &quot;^5.0&quot;,
          &quot;symfony/stopwatch&quot;: &quot;^5.0&quot;,
          &quot;symfony/templating&quot;: &quot;^5.0&quot;,
          &quot;symfony/translation&quot;: &quot;^5.0&quot;,
          &quot;symfony/twig-bundle&quot;: &quot;^5.0&quot;,
          &quot;symfony/validator&quot;: &quot;^5.0&quot;,
          &quot;symfony/webpack-encore-bundle&quot;: &quot;^1.0&quot;,
          &quot;symfony/yaml&quot;: &quot;^5.0&quot;,
          &quot;twig/extensions&quot;: &quot;^1.5&quot;
      },
      //...
      &quot;extra&quot;: {
          &quot;symfony&quot;: {
              &quot;allow-contrib&quot;: false,
              &quot;require&quot;: &quot;5.0.*&quot;
          }
      },
      &quot;require-dev&quot;: {
          &quot;roave/security-advisories&quot;: &quot;dev-latest&quot;,
          &quot;symfony/maker-bundle&quot;: &quot;^1.12&quot;,
          &quot;symfony/profiler-pack&quot;: &quot;^1.0&quot;,
          &quot;symfony/var-dumper&quot;: &quot;^5.0&quot;
      }
  }
  </code></pre>
  <p>I've made a &quot;composer update&quot; just before replacing 4.4 by 5.0 to be sure to be on the lastest version on 4.4.x version.</p>