作曲家更新程序包/名称--with-dependencies不将依赖项列入白名单

Question

我正在尝试仅更新单个软件包及其依赖项。当我尝试空运行时，它似乎正确列出了所有需要更新的软件包：

> composer update drupal/core --with-dependencies --dry-run
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 17 updates, 0 removals
  - Updating guzzlehttp/psr7 (1.3.1) to guzzlehttp/psr7 (1.4.2)
  - Updating guzzlehttp/guzzle (6.2.2) to guzzlehttp/guzzle (6.2.3)
  - Updating symfony/class-loader (v2.8.17) to symfony/class-loader (v2.8.18)
  - Updating symfony/debug (v2.8.17) to symfony/debug (v2.8.18)
  - Updating symfony/console (v2.8.17) to symfony/console (v2.8.18)
  - Updating symfony/dependency-injection (v2.8.17) to symfony/dependency-injection (v2.8.18)
  - Updating symfony/http-foundation (v2.8.17) to symfony/http-foundation (v2.8.18)
  - Updating symfony/event-dispatcher (v2.8.17) to symfony/event-dispatcher (v2.8.18)
  - Updating symfony/http-kernel (v2.8.17) to symfony/http-kernel (v2.8.18)
  - Updating symfony/process (v2.8.17) to symfony/process (v2.8.18)
  - Updating symfony/routing (v2.8.17) to symfony/routing (v2.8.18)
  - Updating symfony/serializer (v2.8.17) to symfony/serializer (v2.8.18)
  - Updating symfony/translation (v2.8.17) to symfony/translation (v2.8.18)
  - Updating symfony/validator (v2.8.17) to symfony/validator (v2.8.18)
  - Updating symfony/yaml (v2.8.17) to symfony/yaml (v2.8.18)
  - Updating twig/twig (v1.31.0) to twig/twig (v1.33.0)
  - Updating zendframework/zend-feed (2.7.0) to zendframework/zend-feed (2.8.0)

但是，当我运行不带的相同命令时--dry-run，不会更新任何软件包：

> composer update drupal/core --with-dependencies
Gathering patches for root package.
Dependency "asm89/stack-cors" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "composer/semver" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "doctrine/annotations" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "doctrine/common" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "easyrdf/easyrdf" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "egulias/email-validator" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "guzzlehttp/guzzle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "masterminds/html5" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "paragonie/random_compat" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "stack/builder" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony-cmf/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/class-loader" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/dependency-injection" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/event-dispatcher" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/http-foundation" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/http-kernel" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/polyfill-iconv" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/process" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/psr-http-message-bridge" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/serializer" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/translation" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/validator" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/yaml" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "twig/twig" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "zendframework/zend-diactoros" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "zendframework/zend-feed" is also a root requirement, but is not explicitly whitelisted. Ignoring.

--with-dependencies-switch 是否不应该将的所有依赖项都列入白名单drupal/core，从而导致这些依赖项也被更新？

Answer 1

原因是Drupal（drupal/drupal）专门合并core/composer.json到项目（root）中composer.json。

"extra": {
  "merge-plugin": {
    "include": [
      "core/composer.json"
    ],
    "recurse": false,
    "replace": false,
    "merge-extra": false
},

这导致将drupal/core依赖项视为根依赖项，从而导致“ X也是根要求，但未明确列入白名单。忽略。” 错误。

解决方法是，通过更新整个项目composer update或禁用composer.json文件的合并部分。