title: installing a laravel package using composer without updating dependencies
body: <p>I want to install zizaco/entrust package in laravel 5.8, in their <a href="https://github.com/Zizaco/entrust" rel="nofollow noreferrer">github</a> page it was said to include &quot;zizaco/entrust&quot;: &quot;5.2.x-dev&quot; in composer.json file and run <strong>composer update</strong> command. I did so as below and ran composer update command.</p>
  <pre><code>&quot;require&quot; : {
          &quot;php&quot; : &quot;^7.1.3&quot;,
          &quot;fideloper/proxy&quot; : &quot;^4.0&quot;,
          &quot;laravel/framework&quot; : &quot;5.8.*&quot;,
          &quot;laravel/tinker&quot; : &quot;^1.0&quot;,
          &quot;laravel/ui&quot; : &quot;^1.2&quot;,
          &quot;maatwebsite/excel&quot; : &quot;^3.1&quot;,
          &quot;zizaco/entrust&quot; : &quot;5.2.x-dev&quot;
      },
  </code></pre>
  <p>but <em>composer update</em> command updates all packages to latest versions (these packages i included in &quot;require&quot; field as above) when installing zizaco/entrust package. So is if there are some coding faults in latest updated packages then whole site can break. FYI after i run the above command i see local git showing changes in many files in folders under vendor folder, it means that there are some updates in packages right?. so it's recommended that <strong>composer install</strong> command should be run so that those dependency packages will not be updated to latest versions.</p>
  <p>So, in my case after including &quot;zizaco/entrust&quot;: &quot;5.2.x-dev&quot; in require field in composer.json as above, if i run <strong>composer install</strong> then it don't install zizaco/entrust package. Furthermore, if i run <strong>composer require zizaco/entrust 5.2.x-dev</strong> then it still installs latest versions of dependency packages.</p>
  <p>So how do i prevent installing latest versions of dependency packages i included in &quot;require&quot; field in composer.json file and i only install zizaco/entrust package.</p>
  <p>So that my laravel 5.8 site don't break for updating any packages to latest versions because of malfunction codes or whatever in latest versions. It's very important to handle this scenario because we need to install packages in laravel site for various needs.</p>