Only update composer lock hash composer update nothing or composer update --lock More clean way composer update nothing --no-scripts --no-autoloader