Do not update a specific package

Question

Is there a way to tell composer that each time I do a composer update I want him to ignore a specific package?

Answer 1

Have you considered specifying the required version for the package you are trying to ignore? For instance:

"require": {
    "some/package": "~1.2"
}

This may get updated, because you are saying any version >=1.2,<2.0, But if you strictly say you want only version 1.0, you should not see any updates to that package:

"require": {
    "some/package": "1.2"
}

Answer 2

Actually I don't know if there is any way to tell composer to exclude one specific package from updating but you can tell which packages to update as

composer update <package> <package2>; // or
php composer.phar update <package> <package2>;

For example,

composer update foo/package1 bar/package2; // or
php composer.phar update foo/package1 bar/package2;

Also, I think, if you don't list them in composer.json (remove after installation) by yourself, then they will not be updated unless also specified in the list.

From Composer: If you only want to install or update one dependency, you can whitelist them:

$ php composer.phar update monolog/monolog [...]

Check this link and also check Composer.

Update : (found on internet but not tested)

To do that, just remove the package from composer.lock

Answer 3

To ignore a specific package, you can use provide (if it's part of your own package) or replace. This tells Composer that you wish to provide/replace a specific package, so it won't download it.

Here is the composer.json file example which should work:

{
    "require": {
        "radic/tmp-underscore-php": "~1.2.0"
    },
    "replace": {
        "patchwork/utf8": "*"
    }
}

In this example, the patchwork/utf8 package would be ignored on composer install or update.

To exclude specific version, see: Composer exclude specific versions.

Answer 4

Update: Only availble for composer versions 1.0.0-alpha6 and lower. Using it in version 1.0.0-alpha7 and higher will remove all packages in "require-dev".

I believe currently you can trick composer with some mess if you can afford it in your project. Something like: Put all packages you don't want to update in "require-dev" and run updates with composer update --no-dev

Just be careful of that if you run composer install as i recall they will be removed from your project.

All this trickery is really nasty, so we should wait for official way of doing things like that, personally i update packages explicitly specifying them