Oh but main composer.json don't have dependency to "knplabs/gaufrette", I can PR lock after update. 
When I try update SyliusCoreBundle I got also problem with doctrine/doctrine-bundle ~1.3@dev -> no matching package found. Stof suggests https://github.com/doctrine/DoctrineBundle/issues/276#issuecomment-36508753
but we have dependency to doctrine/doctrine-cache-bundle in SyliusSettingsBundle. It's like spider web :D Maybe somebody else can resolve this ?