composer why explains a version you did not choose

When Composer installs an old version of something you never asked for, the answer is always a transitive constraint — and reading composer.lock to find which package imposed it is a bad use of an afternoon.

composer why psr/log

monolog/monolog  1.21.0  requires  psr/log (~1.0)
laravel/framework 5.3.0 requires  psr/log (~1.0)

composer why-not psr/log 2.0

why-not is the more useful half: it explains what is blocking an upgrade rather than what depends on the current version, which is the question you actually have. Both were depends and prohibits before 1.0 and the old names still work. Neither needs the packages installed — they read the lock file.