How to bring project into compliance with composer.json?

Question

That must be what composer install is supposed to do. But it doesn't remove no longer needed packages. Well, I can remove packages with composer remove PACKAGE instead of editing composer.json by hand, but that still leaves dependencies in composer.lock and vendor dir.

Answer 1

If composer remove PACKAGE does not work, probably the package that you don't require is required by another package.

if you want to make sure, delete vendor folder and do a composer update (beware of the vendor/package: * that you have on your composer.json)

If the vendor still have that package, it's because it's needed by another.