{"action":"created","issue":{"url":"https://api.github.com/repos/composer/composer/issues/3751","labels_url":"https://api.github.com/repos/composer/composer/issues/3751/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/3751/comments","events_url":"https://api.github.com/repos/composer/composer/issues/3751/events","html_url":"https://github.com/composer/composer/issues/3751","id":57826829,"number":3751,"title":"install should have a --prune flag","user":{"login":"yehosef","id":149253,"avatar_url":"https://avatars.githubusercontent.com/u/149253?v=3","gravatar_id":"","url":"https://api.github.com/users/yehosef","html_url":"https://github.com/yehosef","followers_url":"https://api.github.com/users/yehosef/followers","following_url":"https://api.github.com/users/yehosef/following{/other_user}","gists_url":"https://api.github.com/users/yehosef/gists{/gist_id}","starred_url":"https://api.github.com/users/yehosef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yehosef/subscriptions","organizations_url":"https://api.github.com/users/yehosef/orgs","repos_url":"https://api.github.com/users/yehosef/repos","events_url":"https://api.github.com/users/yehosef/events{/privacy}","received_events_url":"https://api.github.com/users/yehosef/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-02-16T16:46:23Z","updated_at":"2015-02-17T16:28:12Z","closed_at":null,"body":"If I remove dependencies from my composer.json file, the only way (I know of) to actually get those removed from my vendor directory is to do a composer update.   This will also update my versions to the latest matching version, which is not necessarily what I was trying to do. \r\n\r\nEg, If I have two packages\r\n\r\n    AAA/aaa ~1\r\n    BBB/bbb ~2\r\n\r\nand I am currently at version 1.0 of `AAA/aaa` and they released 1.1, but I'm not looking to upgrade because I need to run my tests, etc...\r\nwhen I delete `BBB/bbb` and want to remove it from my vendor (because it something like a geoip database that's 50MB) - I'll automatically be upgraded to 1.1, which I don't want.  \r\n\r\nWhat I want is to be able to run a `composer install --prune` which will go through the dependencies in composer.json and install the specific versions mentioned in composer.lock (if they exist), install appropriate versions if they don't exist, and remove any irrelevant packages from vendor and composer.lock that do not match a dependency in composer.json"},"comment":{"url":"https://api.github.com/repos/composer/composer/issues/comments/74697498","html_url":"https://github.com/composer/composer/issues/3751#issuecomment-74697498","issue_url":"https://api.github.com/repos/composer/composer/issues/3751","id":74697498,"user":{"login":"yehosef","id":149253,"avatar_url":"https://avatars.githubusercontent.com/u/149253?v=3","gravatar_id":"","url":"https://api.github.com/users/yehosef","html_url":"https://github.com/yehosef","followers_url":"https://api.github.com/users/yehosef/followers","following_url":"https://api.github.com/users/yehosef/following{/other_user}","gists_url":"https://api.github.com/users/yehosef/gists{/gist_id}","starred_url":"https://api.github.com/users/yehosef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yehosef/subscriptions","organizations_url":"https://api.github.com/users/yehosef/orgs","repos_url":"https://api.github.com/users/yehosef/repos","events_url":"https://api.github.com/users/yehosef/events{/privacy}","received_events_url":"https://api.github.com/users/yehosef/received_events","type":"User","site_admin":false},"created_at":"2015-02-17T16:28:12Z","updated_at":"2015-02-17T16:28:12Z","body":"What about this.\n\nAfter the current flow for a composer install finishes, a `--prune` option\nwould build a list of top level directories currently in vendor\n(/vendor/<vendor>/<package>).  You would loop through those directories and\nany directory that is not in the list of packages from the composer.lock\nyou would delete.\n\nWhat do you think  - do you see any issues with this approach?\n\nOn Tue, Feb 17, 2015 at 5:44 PM, Rob <notifications@github.com> wrote:\n\n> I think the main problem is that there is no way to fully automate this.\n>\n> Install behaves differently depending on the availability of a .lock file\n> or not.\n>\n> Update updates everything unless you specifically pass in a whitelist of\n> packages.\n>\n> *Regarding cleanup:*\n>\n>    - Update should take care of that (afaik).\n>    - Install does not (afaik), but then again I don't see why it should.\n>    Install is not update, it should just install (either from scratch of from\n>    .lock file).\n>\n> I think what you're asking for, is a check in the install flow, that\n> determines if there is a vendor directory already or not, and if so, cleans\n> it up while installing specific versions.\n>\n> I'm not sure how it could properly do that though, other than just\n> removing everything and installing only what is required (which could make\n> the install procedure quite lengthy unnecessarily).\n>\n> I know there is also an installed.json in the vendor directory (\n> vendor/composer/installed.json). I would imagine this is (or could be)\n> used for something the above describes.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/composer/composer/issues/3751#issuecomment-74688683>.\n>\n"}}