I have seen a few posts answering this and saying that "composer require package" or "composer update package" will do this; but absolutely everything i do with composer attempts to update everything listed in require section of composer.json.

I thought perhaps just removing the require lines in composer.json would avoid this mess; but composer then removes these modules from my docroot.

I simply want to remove my broken (not sure why) version of drush on the server and replace it with a new one without updating core or any contrib modules.

composer remove drush/drush - but it fails the removal and then tries to update everything

xxx:~/www/d8$ composer remove drush/drush drush/drush is not required in your composer.json and has not been removed

DrupalProject\composer\ScriptHandler::checkComposerVersion Package "drush/drush" listed for update is not installed. Ignoring. Loading composer repositories with package information Updating dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages.

any composer command i try (rmeove, update, require) seems to want to update everything.. and then fails because of dependencies conflicts (which is good; since I don't want anything being updated anyway).


    "name": "drupal-composer/drupal-project",
    "description": "Project template for Drupal 8 projects with composer",
    "type": "project",
    "license": "GPL-2.0-or-later",
    "authors": [
            "name": "",
            "role": ""
    "repositories": [
            "type": "composer",
            "url": "https://packages.drupal.org/8"
    "require": {
        "php": ">=7.0.8",
        "composer/installers": "^1.2",
        "cweagans/composer-patches": "^1.6.5",
        "drupal-composer/drupal-scaffold": "^2.5",
        "drupal/address": "^1.7",
        "drupal/admin_toolbar": "^1.27",
        "drupal/auto_entitylabel": "^3.0@beta",
        "drupal/backup_migrate": "^4.0",
        "drupal/block_class": "^1.0",
        "drupal/clientside_validation": "^1.2",
        "drupal/coffee": "^1.0@beta",
        "drupal/commerce": "2.17",
        "drupal/conditional_fields": "^1.0@alpha",
        "drupal/console": "^1.0.2",
        "drupal/content_access": "^1.0@alpha",
        "drupal/core": "^8.7.0",
        "drupal/csv_serialization": "^1.4",
        "drupal/ctools": "^3.2",
        "drupal/date_popup": "^1.0",
        "drupal/date_popup_timepicker": "^1.0@alpha",
        "drupal/entity_reference_revisions": "^1.7",
        "drupal/external_links_new_tab": "^1.2",
        "drupal/extlink": "^1.1",
        "drupal/field_group": "^1.0",
        "drupal/field_permissions": "^1.0@RC",
        "drupal/filefield_paths": "^1.0@beta",
        "drupal/fillpdf": "4.x-dev",
        "drupal/viewsreference": "^1.4",
        "drush/drush": "^10.2",
        "vlucas/phpdotenv": "^2.4",
        "webflo/drupal-finder": "^1.0.0",
        "webmozart/path-util": "^2.3",
        "zaporylie/composer-drupal-optimizations": "^1.0"
    "require-dev": {
        "webflo/drupal-core-require-dev": "^8.7.0"
    "conflict": {
        "drupal/drupal": "*"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "sort-packages": true
    "autoload": {
        "classmap": [
        "files": ["load.environment.php"]
    "scripts": {
        "pre-install-cmd": [
        "pre-update-cmd": [
        "post-install-cmd": [
        "post-update-cmd": [
    "extra": {
        "composer-exit-on-patch-failure": true,
        "patchLevel": {
            "drupal/core": "-p2"
        "installer-paths": {
            "web/core": ["type:drupal-core"],
            "web/libraries/{$name}": ["type:drupal-library"],
            "web/modules/contrib/{$name}": ["type:drupal-module"],
            "web/profiles/contrib/{$name}": ["type:drupal-profile"],
            "web/themes/contrib/{$name}": ["type:drupal-theme"],
            "drush/Commands/contrib/{$name}": ["type:drupal-drush"]
        "patches": {
            "drupal/core": {
                "Drag-drop fix for field group config": "https://www.drupal.org/files/issues/2019-12-09/drupal-tabledrag_testing-2769825-48.patch",
                "part of above": "https://www.drupal.org/files/issues/2019-11-21/3062742_4.patch",
                "multiple terms in views issues": "https://www.drupal.org/files/issues/2019-11-14/drupal-empty_value_fix-2882076-14.patch",
                "more drag-drop fixes": "https://www.drupal.org/files/issues/2019-12-14/3089151-17-D8.patch"
            "drupal/conditional_fields": {
                "Date field value is always empty": "https://www.drupal.org/files/issues/2020-01-19/conditional_fields-date_fields_empty-2956612-8.patch"
            "drupal/fillpdf": {
                "Add token support for before/after text": "https://www.drupal.org/files/issues/2020-02-18/3109697-6.patch"
            "drupal/field_group": {
                "Conditional field support": "https://www.drupal.org/files/issues/2019-12-10/field_group-support_conditional_fields-3099051-6.patch",
                "HTML5 validation broken in tabs": "https://www.drupal.org/files/issues/2019-10-04/field_group-HTML5_validation_prevents_submission_in_tabs-2969051-9.patch"
            "drupal/serial": {
                "Feeds support": "https://www.drupal.org/files/issues/2020-02-28/serial-feeds-support-3035978-6.patch"
        "drupal-scaffold": {
            "initial": {
                ".editorconfig": "../.editorconfig",
                ".gitattributes": "../.gitattributes"
  • This sounds really odd. Can you please add your current composer.json to your question and name your composer --version please?
    – leymannx
    Mar 19, 2020 at 19:38
  • 2
    What does composer remove drush/drush --no-update do?
    – mpdonadio
    Mar 19, 2020 at 22:51
  • adding --no-update means the only thing done is to add/remove the line from the composer.json.. it doesn't actually do anything else. Based on if that line has been added or removed (i suspect same to just remove it manually), when composer update or any action without --no-update, it will then be removed or added.. and sadly, everything else will be updated.
    – liquidcms
    Mar 20, 2020 at 21:17
  • Maybe composer.lock or the vendor folder is missing, and any operation would mean Composer needs to install what it thinks is missing (invoking the dependency check)?
    – Clive
    Mar 20, 2020 at 22:08
  • No. These are all in place. Perhaps my question is worded wrong? I should have maybe started with "How do you install/remove/update a composer package without updating everything?"
    – liquidcms
    Mar 24, 2020 at 18:31

1 Answer 1


The proper way is composer require package/name, composer remove package/name, or composer update package/name. Version number is optional. You are doing it correctly.

The line about "Updating dependencies" is expected. It is not updating the versions of your packages (unless required by the require/remove statement), it's updating dependency information based on your require/remove/update.

  • No. Its updating everything that has a newer version.
    – liquidcms
    Aug 12, 2020 at 18:53
  • 2
    If you have a composer.lock file and you are doing a composer require package/name then it will not update everything. If your vendor/ directory does not match what is in the composer.lock file composer will update (or downgrade) packages in the vendor folder to match what is in the lock file. If you are seeing packages update with acomposer require then something else is going on, or you are misinterpreting the output you are seeing. composer require does not do an update on all available packages. My assumption here is misinterpretation of the output.
    – Steven W
    Aug 21, 2020 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.