如何在composer中列出孤立包

Question

I have a project with several outdated dependencies.

One of the dependencies is just listed up in composer.lock

I removed every package from composer.json with

composer remove <package>

but the package is still listed in composer.lock. So it seems that this is an orphan package.

If use

composer depends <package>

it returns "could not find package"

• Is it safe to remove the package?
• Is there a command to check for orphan packages?

Answer 1

Finally I just removed the package.

I checked if the package was used in the source with grep

grep -rnwi vendor/ -e "namespace"

As the the package was listed in the dev section, I run

composer install --no-dev

Then I removed the packages from the composer.lock

and run

composer install

The package was not installed again