Remove a package using composer (without updating other packages)

Question

I've currently installed a package "watson/sitemap". Now, I want to remove it without using "composer update" since it will update other packages which I don't want.

Any help would be much appreciated.

Answer 1

UPDATE: Composer 2 is now out, and it seems to be smart enough to handle the recursion. You need only remove the offending package.

I recently needed to do this. Here's a real-world example. This is pretty hacky. You could script this by using Composer's PHP classes or by parsing the composer.lock file, but this is a manual process you can follow.

1. Remove the unwanted package(s)

composer remove --no-update illuminate/mail
composer update illuminate/mail

2. Look for orphaned dependencies

composer show -N | xargs -n 1 composer why | grep "There is no installed package"

Output (something like this):

There is no installed package depending on "erusev/parsedown"
There is no installed package depending on "swiftmailer/swiftmailer"
There is no installed package depending on "tijsverkoyen/css-to-inline-styles"

3. Remove orphaned dependencies

composer update erusev/parsedown swiftmailer/swiftmailer tijsverkoyen/css-to-inline-styles

4. Rinse, repeat

Repeat steps 2 and 3 until you've found all the orphans.

---

Clarification: If you use the --no-update flag, you won't upgrade packages... however (as of writing, early 2020) it also does not remove orphaned dependencies. You're not telling it not to "upgrade". You're telling it not to update any of the installed (composer.lock) dependencies. Big difference. This is why you have to find them and manually "update" them out of your project.

Answer 2

Right way:

composer remove watson/sitemap --no-update

From CLI Docs:

The remove command removes packages from the composer.json file from the current directory.

php composer.phar remove vendor/package vendor/package2

After removing the requirements, the modified requirements will be uninstalled.

Hack way:

Remove the entry from composer.json then run

composer update watson/sitemap

This will remove a package totally from composer.lock and /vendor