I am using pre-beta release of Laravel 5 for my project.
I found out that the app skeleton of Laravel 5 was changed in the github repo and since it is a development version, that is expected to change quite frequently.
My question is, can I update only the specific dependencies using composer and not the framework itself? So that I don't have to worry about the changing app structure until I am ready to make changes?
Here is how the composer.json dependencies look:
"require": {
"laravel/framework": "~5.0"
},
"require-dev": {
"phpunit/phpunit": "~4.0",
"way/generators": "~3.0",
"fzaninotto/faker": "~1.5#dev"
},
Thank you.
While the composer update package package ... answer is a good one, another thing you might be able to do is change your Laravel require spec to a specific commit. The Composer documentation mentions how to do this, and I've done it myself on a project (though not with laravel, on my own packages which are also in a breaking/dev state).
"require": {
"laravel/framework": "dev-master#49e3c77b518547bb661b1de4fda64a3ae0c5c505",
...
}
I'd hope that, because laravel/framework 'replaces' the various illuminate/* packages, that any reliance on these (as long as the spec is 5.0-esque) that this would work without downloading the illuminate packages twice.
Doing it this way you can lock your laravel/framework (or any package) at a given commit, but still allow the standard composer update to work.
To find out what commit you're already on, if your laravel/framework dependency spec is a dev one then the vendor/laravel/framework/ directory itself should be a git repo, so just do git status in there to get the HEAD ref. Alternatively, look in composer.lock for the laravel/framework entry's source.reference value.
Composer allows you to do specific package upgrades. I used this literally the other night to upgrade a single package to fix a bug, but I didn't want to change anything else.
composer update <package1> <package2> <...>
So in your case
composer update phpunit/phpunit way/generators fzaninotto/faker
It might be more complicated when you have lots of packages - but it is a solution that works.
Yes, you can simply call
composer update vendor/package
without updating your whole project.
It will work for the packages pulled by yourself and for the dependencies
You can't really. If you use Laravel 5 this is a thing you need to deal with, development versions come with this backdraw.
Related
When I run composer update, a lot of dependencies and my composer.json get updated. But, my composer.json didn't change, so next time I run composer install, I'll get the outdated ones again.
For instance, I have:
"require": {
"symfony/form": "^4.1",
}
When I run the command It shows:
Updating symfony/dotenv (v4.1.4 => v4.1.5): Loading from cache
But the json line stays the same, and composer install will install the 4.1.4 version.
Is there a way to update the composer.json file when I run composer update?
Thanks in advance!
You should have a composer.lock file after performing composer update. You commit this file to version control and then the next person checks out the code can do composer install to obtain the correct version.
The composer.json file contains the version constraints whereas the composer.lock file contains the specific version.
Take a look at the example you had:
"require": {
"symfony/form": "^4.1",
}
Here the version constraint for the symfony/form package is ^4.1. This means that it will accept any version 4 build from 4.1, but not version 5 or higher. So it could obtain version 4.1.1, or 4.2.13 or anything higher (but below version 5).
https://getcomposer.org/doc/articles/versions.md#caret-version-range-
here are the docs on lock files
https://getcomposer.org/doc/02-libraries.md#lock-file
I'm using Composer and upon the last install, got the message:
Package guzzle/guzzle is abandoned, you should avoid using it. Use
guzzlehttp/guzzle instead.
I went to my composer.lock file and saw that some of my packages were using guzzle/guzzle while other packages were using guzzlehttp/guzzle:
"require-dev": {
"amphp/artax": "*#dev",
"ext-curl": "*",
"guzzle/guzzle": "*",
A few questions come to mind:
Is there any way to update those packages with guzzlehttp/guzzle?
And if I did do this, wouldn't it be possible that the packages which use guzzle/guzzle no longer qorks?
Would the best course of action be to wait for the package author to change the dependency to guzzlehttp/guzzle and then re-install?
I think the best way is to wait for the original package author to change that and then update that package in your project.
A way for you to change it yourself could be to fork that package and test all the stuff yourself.
But I see no need to change that if your project works fine. It's just a message that guzzle/guzzle is no longer maintained, but that doesn't mean that it is not working anymore. Just a suggestion to use guzzlehttp/guzzle as this is the latest maintained version now.
tl;dr: I'm having troubles forcing Composer to get latest changes to my local package. It seems, that problem is caused by latest change not being part of any release in packages repository.
I'm using yii2-language-picker in my project and have added it with instructions given in docs:
php composer.phar require --prefer-dist lajax/yii2-language-picker "1.*"
Recently extension's author has made a change. However, this change is not part of any release, because it is 1 commit after latest release. If I'm not mistaken (I'm quite new to Composer), this causes Composer to not update my local package -- after composer update or composer install I'm getting Nothing to install or update.
Because that latest change is not a part of any relase, I was suggested to edit composer.json file, change "lajax/yii2-language-picker": "1.*" in required section to "lajax/yii2-language-picker": "*" and issue another composer update.
I have also completely removed this package and installed it again with both "1.*" and "**".
None of these brought any effects. Composer still claims, that there is nothing to install or update.
What can be causing this situation? Is there anything I can do in this case, or the only option I'm left with is to sit down and wait until package / repository author will make that change part of another release?
I tried to manually update this package, but after composer status I'm getting No local changes and I'm woried, that all these changes will be lost, once actual package update will be released. Should I make any local changes in this situation or should I sit and wait?
Changing 1.* to dev-master probably solves your problem.
Is there a way to tell composer that each time I do a composer update I want him to ignore a specific package?
Have you considered specifying the required version for the package you are trying to ignore? For instance:
"require": {
"some/package": "~1.2"
}
This may get updated, because you are saying any version >=1.2,<2.0, But if you strictly say you want only version 1.0, you should not see any updates to that package:
"require": {
"some/package": "1.2"
}
Actually I don't know if there is any way to tell composer to exclude one specific package from updating but you can tell which packages to update as
composer update <package> <package2>; // or
php composer.phar update <package> <package2>;
For example,
composer update foo/package1 bar/package2; // or
php composer.phar update foo/package1 bar/package2;
Also, I think, if you don't list them in composer.json (remove after installation) by yourself, then they will not be updated unless also specified in the list.
From Composer:
If you only want to install or update one dependency, you can whitelist them:
$ php composer.phar update monolog/monolog [...]
Check this link and also check Composer.
Update : (found on internet but not tested)
To do that, just remove the package from composer.lock
Update: Only availble for composer versions 1.0.0-alpha6 and lower. Using it in version 1.0.0-alpha7 and higher will remove all packages in "require-dev".
I believe currently you can trick composer with some mess if you can afford it in your project. Something like: Put all packages you don't want to update in "require-dev" and run updates with composer update --no-dev
Just be careful of that if you run composer install as i recall they will be removed from your project.
All this trickery is really nasty, so we should wait for official way of doing things like that, personally i update packages explicitly specifying them
To ignore a specific package, you can use provide (if it's part of your own package) or replace. This tells Composer that you wish to provide/replace a specific package, so it won't download it.
Here is the composer.json file example which should work:
{
"require": {
"radic/tmp-underscore-php": "~1.2.0"
},
"replace": {
"patchwork/utf8": "*"
}
}
In this example, the patchwork/utf8 package would be ignored on composer install or update.
To exclude specific version, see: Composer exclude specific versions.
I have a project with a few dependencies and I'd like to install another one, but I'd like to keep the others the way they are. So I've edited the composer.json, but if I run composer install, I get the following output:
Installing dependencies from lock file
Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. Run update to update them.
Your requirements could not be resolved to an installable set of packages.
Problem 1
- laravel/framework dev-master requires ext-mcrypt * -> the requested PHP extension mcrypt is missing from your system.
- laravel/framework dev-master requires ext-mcrypt * -> the requested PHP extension mcrypt is missing from your system.
- Installation request for laravel/framework dev-master -> satisfiable by laravel/framework dev-master.
First of all, I do have mcrypt installed, so I don't know why it's complaining about that there.
So, how can I install this new dependency?
My composer.json:
{
"require": {
"opauth/opauth": "*",
"opauth/facebook": "*",
"opauth/google": "*",
"opauth/twitter": "*",
"imagine/Imagine": "dev-develop",
"laravel/framework": "4.*",
"loic-sharma/profiler": "dev-master"
},
"autoload": {
"classmap": [
"app/libraries",
"app/commands",
"app/controllers",
"app/models",
"app/database/migrations",
"app/tests/TestCase.php"
]
},
"minimum-stability": "dev"
}
To install a new package and only that, you have two options:
Using the require command, just run:
composer require new/package
Composer will guess the best version constraint to use, install the package, and add it to composer.lock.
You can also specify an explicit version constraint by running:
composer require new/package ~2.5
–OR–
Using the update command, add the new package manually to composer.json, then run:
composer update new/package
If Composer complains, stating "Your requirements could not be resolved to an installable set of packages.", you can resolve this by passing the flag --with-dependencies. This will whitelist all dependencies of the package you are trying to install/update (but none of your other dependencies).
Regarding the question asker's issues with Laravel and mcrypt: check that it's properly enabled in your CLI php.ini. If php -m doesn't list mcrypt then it's missing.
Important: Don't forget to specify new/package when using composer update! Omitting that argument will cause all dependencies, as well as composer.lock, to be updated.
Actually, the correct solution is:
composer require vendor/package
Taken from the CLI documentation for Composer:
The require command adds new packages to the composer.json file from the current directory.
php composer.phar require
After adding/changing the requirements, the modified requirements will be installed or updated.
If you do not want to choose requirements interactively, you can just pass them to the command.
php composer.phar require vendor/package:2.* vendor/package2:dev-master
While it is true that composer update installs new packages found in composer.json, it will also update the composer.lock file and any installed packages according to any fuzzy logic (> or * chars after the colons) found in composer.json! This can be avoided by using composer update vendor/package, but I wouldn't recommend making a habit of it, as you're one forgotten argument away from a potentially broken project…
Keep things sane and stick with composer require vendor/package for adding new dependencies! 😉
We can install a new package without updating other dependencies like this:
composer require package/name --no-update
this will add your package to composer.json (no update to composer.lock)
composer update package/name
this will now install/update your new package, adding it to composer.lock without updating other deps
My use case is simpler, and fits simply your title but not your further detail.
That is, I want to install a new package which is not yet in my composer.json without updating all the other packages.
The solution here is composer require x/y
In my case, I had a repo with:
requirements A,B,C,D in .json
but only A,B,C in the .lock
In the meantime, A,B,C had newer versions with respect when the lock was generated.
For some reason, I deleted the "vendors" and wanted to do a composer install and failed with the message:
Warning: The lock file is not up to date with the latest changes in composer.json.
You may be getting outdated dependencies. Run update to update them.
Your requirements could not be resolved to an installable set of packages.
I tried to run the solution from Seldaek issuing a composer update vendorD/libraryD but composer insisted to update more things, so .lock had too changes seen my my git tool.
The solution I used was:
Delete all the vendors dir.
Temporarily remove the requirement VendorD/LibraryD from the .json.
run composer install.
Then delete the file .json and checkout it again from the repo (equivalent to re-adding the file, but avoiding potential whitespace changes).
Then run Seldaek's solution composer update vendorD/libraryD
It did install the library, but in addition, git diff showed me that in the .lock only the new things were added without editing the other ones.
(Thnx Seldaek for the pointer ;) )