Why can dnf remove delete far more than the one package you named?
Because DNF removes the package and everything that depends on it, recursively — so removing a widely-used library can cascade into a long list of dependent packages.
DNF protects you from breaking a system by leaving "dangling" dependencies. When you remove a package, it:
- Identifies the target package.
- Finds every package that requires it.
- Recurses — finds packages that depend on those, and so on.
- Presents the complete list before doing anything.
- Waits for your confirmation.
dnf remove httpd
# might also pull: mod_ssl (needs httpd), php (needs httpd),
# and any web app packages built on it
This is a feature, not a bug: silently leaving php installed after deleting the httpd it runs on would create a broken, half-working system. So DNF would rather show you the full blast radius.
The discipline: always read the removal list. A surprisingly large list is a signal — the package you're removing is depended on by many others, so stop and ask whether you really want all of them gone. If you only want to remove the single package and let the install fail when others need it, the low-level rpm -e httpd does exactly that (it refuses if something depends on it).