1. STEP 1: Update single vendor package only
2. STEP 2: Update composer.lock

The tips here are for advanced usages of composer and its assumed you have read about using composer and have a knowledge of your vendor packages to be updated. Let's consider, you want to update only one specific yii2 vendor library, without updating all the other extension packages?

STEP 1: Update single vendor package only ¶

Let's say the package name is vend/pkg. Run the following command.

php composer.phar update vend/pkg

This will only install or update the vend/pkg extension (plus its dependencies) and overwrite the composer.lock.

STEP 2: Update composer.lock ¶

When you do step 1, you should most likely receive a warning message like below

Note: The lock file is not up to date with the latest changes in composer.json, you may be getting outdated dependencies, run update to update them.

Do not worry. This is a message you should expect similar to when you edit the composer.json file. For example, if you add or update a detail like the library description, authors, extra parameters, or even put a trailing whitespace, this will change the md5sum of the file. Then composer will warn you if this hash differs from the one stored in the composer.lock.

To proceed further, just update the lock file with the following command:

php composer.phar update --lock

Thus, composer will bring your composer.lock file up to date but NOT UPDATE all your other Yii2 vendor packages.