19

I've currently installed a package "watson/sitemap". Now, I want to remove it without using "composer update" since it will update other packages which I don't want.

Any help would be much appreciated.

Jonathan Solorzano
  • 6,812
  • 20
  • 70
  • 131
papski
  • 1,241
  • 5
  • 28
  • 52

4 Answers4

26

UPDATE: Composer 2 is now out, and it seems to be smart enough to handle the recursion. You need only remove the offending package.

I recently needed to do this. Here's a real-world example. This is pretty hacky. You could script this by using Composer's PHP classes or by parsing the composer.lock file, but this is a manual process you can follow.

1. Remove the unwanted package(s)

composer remove --no-update illuminate/mail
composer update illuminate/mail

2. Look for orphaned dependencies

composer show -N | xargs -n 1 composer why | grep "There is no installed package"

Output (something like this):

There is no installed package depending on "erusev/parsedown"
There is no installed package depending on "swiftmailer/swiftmailer"
There is no installed package depending on "tijsverkoyen/css-to-inline-styles"

3. Remove orphaned dependencies

composer update erusev/parsedown swiftmailer/swiftmailer tijsverkoyen/css-to-inline-styles

4. Rinse, repeat

Repeat steps 2 and 3 until you've found all the orphans.

Clarification: If you use the --no-update flag, you won't upgrade packages... however (as of writing, early 2020) it also does not remove orphaned dependencies. You're not telling it not to "upgrade". You're telling it not to update any of the installed (composer.lock) dependencies. Big difference. This is why you have to find them and manually "update" them out of your project.

Derrek Bertrand
  • 596
  • 7
  • 13
  • Sir, you save me from a lot of problems. Thanks a lot – manuerumx May 18 '21 at 01:51
  • 1
    Thanks, this helped me a lot. But keep in mind that this won't work for all cases. If an orphaned dependency has a replace then `composer why package/x` won't show "There is no installed package" but instead e.g. "package/x v.1.2.3 replaces package/y (*)". Means the command does not work for those packages. – Ekk4rd May 20 '21 at 13:49
11

Right way:

composer remove watson/sitemap --no-update

From CLI Docs:

The remove command removes packages from the composer.json file from the current directory.

php composer.phar remove vendor/package vendor/package2

After removing the requirements, the modified requirements will be uninstalled.

Hack way:

Remove the entry from composer.json then run 

composer update watson/sitemap

This will remove a package totally from composer.lock and /vendor

Jonathan Solorzano
  • 6,812
  • 20
  • 70
  • 131
0

I'm not sure this is possible. To restate your question. You have watson/sitemap in your composer.json, you've executed a composer update to download the package and it's dependencies. Now you want to remove the package but leave dependent packages in place?

I'm not sure there's a good way to do this, you'll have to run composer update at some point, which will just download it again. If my interpretation is correct, maybe your solution is to just add the other packages that you need that you don't want removed when you get rid of watson/sitemap, possibly sloppy/paste it's dependencies into your composer.json file?

Chris
  • 754
  • 9
  • 16
  • 1
    I didn't use composer update to download the package. I only follow the instructions stated in this link https://github.com/dwightwatson/sitemap. So you are saying that I should get to use "composer update" in order to remove the package? The complication for "composer update" is that it will update other packages which I don't want to happen. – papski Oct 13 '17 at 03:46
  • `composer require` makes it managed by composer. If you then remove the package manually (removing from disk outside composer) a `composer update` will add it back in if it's required as a dependency in your project or as a dependency of something in your `composer.json` file. as mentioned by others... if you don't want it at all anymore, you can do a `composer remove`. I usually just remove it from my `composer.json` file manually, and the next `composer update` will remove all the things that were installed because of it. – Chris Oct 13 '17 at 21:47
  • If you don't want to use `composer update` because it updates other packages, you may want to consider having tighter version requirements in your `composer.json` file. That way you know composer won't upgrade. This isn't the best idea IMO, I usually stick with a version which allows non-breaking change updates from all packages (X.Y.* for some, X.* for others - depending on the project's version scheme) – Chris Oct 13 '17 at 21:48
0

I use

composer remove package-name --no-update-with-dependencies

Works imho

Jo-Anne
  • 41
  • 3