Almost always caused by a moved/force-updated tag. Packagist treats tags as immutable. Fix: delete the
moved tag and cut a new patch version (11.3.1) instead. Never git tag -f a released tag.
- Ensure
vardot/drupal-core-patchesis in the consuming plugin'sallowed-dependency-patches(varbase-patchesincludes it by default). - Ensure
cweagans/composer-patchesandvardot/varbase-patchesare allowed plugins in the root project.
A stable tag must exist on the matching branch. With only a dev branch, require 11.3.x-dev (or use
minimum-stability: dev). Releases provide the stable tags.
Each branch's conflict."drupal/core" binds it to one minor. If a patch was selected for the wrong core,
check that branch's conflict range and the patch URL points to the correct re-rolled file.