Issue #3361983 by effulgentsia, smustgrave: Remove psr/http-message from drupal/core-recommended

composer/Generator/Builder/DrupalCoreRecommendedBuilder.php

@@ -30,7 +30,15 @@ class DrupalCoreRecommendedBuilder extends DrupalPackageBuilder {
     }
 
     // Make a list of packages we do not want to put in the 'require' section.
-    $remove_list = ['drupal/core', 'wikimedia/composer-merge-plugin', 'composer/installers'];
+    $remove_list = [
+      'drupal/core',
+      'wikimedia/composer-merge-plugin',
+      'composer/installers',
+      // This package contains no code other than interfaces, so allow sites
+      // to use any compatible version without needing to switch off of
+      // drupal/core-recommended.
+      'psr/http-message',
+    ];
 
     // Copy the 'packages' section from the Composer lock into our 'require'
     // section. There is also a 'packages-dev' section, but we do not need

composer/Metapackage/CoreRecommended/composer.json

@@ -28,7 +28,6 @@
         "psr/event-dispatcher": "~1.0.0",
         "psr/http-client": "~1.0.2",
         "psr/http-factory": "~1.0.2",
-        "psr/http-message": "~2.0",
         "psr/log": "~3.0.0",
         "ralouphie/getallheaders": "~3.0.3",
         "sebastian/diff": "~4.0.4",