Why are dependencies still present in the installer path after removal?

[Vincent Klaiber]

Why are dependencies that are removed from the composer.json file still present in the installer path? Is this the intended behavior, or is there a solution to remove the dependencies from the installer path as well?

First, I will add a dependency to the installer path.

{
    "require": {
        "php": "^8.2"
    },
    "extra": {
        "installer-paths": {
            "public/mu-plugins/{$name}/": [
                "type:wordpress-muplugin",
+               "wpackagist-plugin/bugsnag"
            ]
    }
}

Then, I will install the plugin by using the composer require command.

composer require wpackagist-plugin/bugsnag

The dependency has been installed correctly in the installer path. Next, I remove it from the composer.json file.

{
    "require": {
        "php": "^8.2",
-       "wpackagist-plugin/bugsnag": "^1.0"
    },
    "extra": {
        "installer-paths": {
            "public/mu-plugins/{$name}/": [
                "type:wordpress-muplugin",
-               "wpackagist-plugin/bugsnag"
            ]
    }
}

Then I run composer update in the root of the project.

composer update

The dependency has been removed from the vendor directory but remains in the installer path.

Related issues: #82 #519