{"action":"opened","issue":{"url":"https://api.github.com/repos/composer/composer/issues/3839","labels_url":"https://api.github.com/repos/composer/composer/issues/3839/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/3839/comments","events_url":"https://api.github.com/repos/composer/composer/issues/3839/events","html_url":"https://github.com/composer/composer/issues/3839","id":60862708,"number":3839,"title":"Proposal: composer fear (lock constraints)","user":{"login":"schmunk42","id":649031,"avatar_url":"https://avatars.githubusercontent.com/u/649031?v=3","gravatar_id":"","url":"https://api.github.com/users/schmunk42","html_url":"https://github.com/schmunk42","followers_url":"https://api.github.com/users/schmunk42/followers","following_url":"https://api.github.com/users/schmunk42/following{/other_user}","gists_url":"https://api.github.com/users/schmunk42/gists{/gist_id}","starred_url":"https://api.github.com/users/schmunk42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schmunk42/subscriptions","organizations_url":"https://api.github.com/users/schmunk42/orgs","repos_url":"https://api.github.com/users/schmunk42/repos","events_url":"https://api.github.com/users/schmunk42/events{/privacy}","received_events_url":"https://api.github.com/users/schmunk42/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-12T17:44:49Z","updated_at":"2015-03-12T17:44:49Z","closed_at":null,"body":"While in the subject `fear` is only a working title, it could also be `lock` or something similar.\r\n\r\nInspired by https://github.com/jonathanong/ferver I thought about the following functionality:\r\n\r\n```\r\ncomposer fear\r\n```\r\n\r\nReplace constraints in your `composer.json` file with values from the current `composer.lock` file.\r\nThis would lock down your app and you ~~would never get updates at all~~ no updates for your root packages - functionality could be extended to lock a single package or subtree or even with dependencies.\r\n\r\nYou could still then make manual changes to the composer.json file and bring back a constraint. Or simply require it.\r\n\r\nThis could help a lot, if you want restrict the updates, eg. after deployment.\r\n\r\nAny thoughts?"}}