{"action":"created","issue":{"url":"https://api.github.com/repos/composer/composer/issues/3960","labels_url":"https://api.github.com/repos/composer/composer/issues/3960/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/3960/comments","events_url":"https://api.github.com/repos/composer/composer/issues/3960/events","html_url":"https://github.com/composer/composer/pull/3960","id":69987492,"number":3960,"title":"composer update --lock buggy / incorrectly documented","user":{"login":"andrewnicols","id":370047,"avatar_url":"https://avatars.githubusercontent.com/u/370047?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewnicols","html_url":"https://github.com/andrewnicols","followers_url":"https://api.github.com/users/andrewnicols/followers","following_url":"https://api.github.com/users/andrewnicols/following{/other_user}","gists_url":"https://api.github.com/users/andrewnicols/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewnicols/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewnicols/subscriptions","organizations_url":"https://api.github.com/users/andrewnicols/orgs","repos_url":"https://api.github.com/users/andrewnicols/repos","events_url":"https://api.github.com/users/andrewnicols/events{/privacy}","received_events_url":"https://api.github.com/users/andrewnicols/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-22T00:35:48Z","updated_at":"2015-04-22T01:17:23Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/composer/composer/pulls/3960","html_url":"https://github.com/composer/composer/pull/3960","diff_url":"https://github.com/composer/composer/pull/3960.diff","patch_url":"https://github.com/composer/composer/pull/3960.patch"},"body":"The documentation for update --lock states:\r\n`Only updates the lock file hash to suppress warning about the lock file being out of date.`\r\n\r\nFrom this I understand that we are performing a `composer update`, which would normally update the dependency tree, update the lock file, and install the dependencies into the vendor directory; but without actually installing the dependencies.\r\n\r\nHowever, if I update my composer.json from one fixed version to another, then call `composer update --lock`, I get a confusing message which suggests that the lock file is being updated based on the data in the composer.json *and* the data currently in composer.lock.\r\n\r\n### Steps to reproduce:\r\n\r\n    # Clone my sample repo and install the dependencies:\r\n    git clone https://github.com/andrewnicols/composer-mtc-issue.git\r\n    git checkout master\r\n    composer install\r\n\r\n    # Bump the version of the dependency, to 1.28.0, or checkout the branch I created for you:\r\n    git checkout versionUpdated\r\n\r\n    # Update the lock file:\r\n    composer update --lock\r\n\r\n### Expected Result\r\nThe lock file is updated without installing the dependencies into the vendor directory.\r\n\r\n### Actual Result\r\nSome confusing mismash of composer.lock + composer.json:\r\n\r\n    Loading composer repositories with package information\r\n    Updating dependencies (including require-dev)\r\n    Your requirements could not be resolved to an installable set of packages.\r\n\r\n      Problem 1\r\n        - The requested package moodlehq/behat-extension == 1.28.6.0 could not be found.\r\n      Problem 2\r\n        - Installation request for moodlehq/behat-extension 1.28.8 -> satisfiable by moodlehq/behat-extension[v1.28.8].\r\n        - Conclusion: remove guzzle/common v3.9.2\r\n        - moodlehq/behat-extension v1.28.8 requires guzzlehttp/guzzle ~3.1 -> satisfiable by guzzlehttp/guzzle[v3.1.0, v3.1.1, v3.1.2, v3.2.0, v3.3.0, v3.3.1, v3.4.0, v3.4.1, v3.4.2, v3.4.3, v3.5.0, v3.6.0, v3.7.0, v3.7.1, v3.7.2, v3.7.3, v3.7.4, v3.8.0, v3.8.1].\r\n        - don't install guzzlehttp/guzzle v3.1.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.1.1|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.1.2|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.2.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.3.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.3.1|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.4.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.4.1|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.4.2|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.4.3|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.5.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.6.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.7.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.7.1|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.7.2|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.7.3|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.7.4|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.8.0|don't install guzzle/common v3.9.2\r\n        - don't install guzzlehttp/guzzle v3.8.1|don't install guzzle/common v3.9.2\r\n        - Installation request for guzzle/common == 3.9.2.0 -> satisfiable by guzzle/common[v3.9.2].\r\n\r\n    Potential causes:\r\n    - A typo in the package name\r\n    - The package is not available in a stable-enough version according to your minimum-stability setting\r\n      see <https://groups.google.com/d/topic/composer-dev/_g3ASeIFlrc/discussion> for more details.\r\n\r\n    Read <http://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.\r\n\r\n\r\n### Usecase\r\nWe wish to add a CI server task which runs composer update --lock to ensure that the lock file is up-to-date with the composer.json and will warn accordingly if someone attempts to push a change to one without a change to the other.\r\nWe do not necessarily need to install the dependencies for this task.\r\n\r\n### Summary\r\nThis could simply be an issue in the documentation - e.g. that --lock does not actually do as we expect, or it could be doing completely the wrong thing."},"comment":{"url":"https://api.github.com/repos/composer/composer/issues/comments/94991783","html_url":"https://github.com/composer/composer/pull/3960#issuecomment-94991783","issue_url":"https://api.github.com/repos/composer/composer/issues/3960","id":94991783,"user":{"login":"andrewnicols","id":370047,"avatar_url":"https://avatars.githubusercontent.com/u/370047?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewnicols","html_url":"https://github.com/andrewnicols","followers_url":"https://api.github.com/users/andrewnicols/followers","following_url":"https://api.github.com/users/andrewnicols/following{/other_user}","gists_url":"https://api.github.com/users/andrewnicols/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewnicols/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewnicols/subscriptions","organizations_url":"https://api.github.com/users/andrewnicols/orgs","repos_url":"https://api.github.com/users/andrewnicols/repos","events_url":"https://api.github.com/users/andrewnicols/events{/privacy}","received_events_url":"https://api.github.com/users/andrewnicols/received_events","type":"User","site_admin":false},"created_at":"2015-04-22T01:17:23Z","updated_at":"2015-04-22T01:17:23Z","body":"I had more of a read of things, and it appears that the --lock option is only intended to update the lock file's hash. As a result, it *will* die horribly if versions between the lock and the json differ.\r\n\r\nI've implemented a --lock-only flag which essentially runs the same operations as a dry-run but does update the lockfile. It is possible to run this *without* a vendor directory."}}