php - Composer - enabling update by deletion of entry in composer.lock

Question

I regularly observe the following behaviour:

When I try to execute composer update mynamespace/myproject, it fails because if conflicts with a dependent project "mynamespace/mydependency", which is 'locked' at a specific version - the version specified in the composer.lock file. I don't get what 'locked' means in that context, but I observe that the update works well once I deleted the entry

{
  name : "mynamespace/mydependency"
  ...
}

from composer.lock. This behaviour is in contrast to what I understood so far that the composer.lock file was supposed to do - recording what exact versions are installed without specifiying any restrictions on composer.json.

Since my assumption has been proven wrong, I would be thankful to some clarification.

question from:https://stackoverflow.com/questions/65920030/composer-enabling-update-by-deletion-of-entry-in-composer-lock

Answer 1

Never ever edit the lock file by hand, that will only cause trouble. If updating a single dependency does not work, you've found the reason already: cause it's still needed in the current version by any other dependency.

To see why an update is not possible, you can use composer why-not, followed by the package name and the version you want to update to. For example, the following command could list why exactly updating to v3 is not possible:

composer why-not mynamespace/myproject 3.0

Now, you can either decide to skip the update for now, or add any of the packages that are listed there to your update command such that these also receive an update.

NB: it's very common that updating a single component (and nothing else) is not possible, especially if this is not a minor update