コンポーザアップデートパッケージ/名前 - 依存関係がホワイトリストに登録されていません

Question

私は1つのパッケージとその依存関係のみを更新しようとしています。私は--dry-runせずに同じコマンドを実行したときに

> composer update drupal/core --with-dependencies --dry-run 
Loading composer repositories with package information 
Updating dependencies (including require-dev) 
Package operations: 0 installs, 17 updates, 0 removals 
    - Updating guzzlehttp/psr7 (1.3.1) to guzzlehttp/psr7 (1.4.2) 
    - Updating guzzlehttp/guzzle (6.2.2) to guzzlehttp/guzzle (6.2.3) 
    - Updating symfony/class-loader (v2.8.17) to symfony/class-loader (v2.8.18) 
    - Updating symfony/debug (v2.8.17) to symfony/debug (v2.8.18) 
    - Updating symfony/console (v2.8.17) to symfony/console (v2.8.18) 
    - Updating symfony/dependency-injection (v2.8.17) to symfony/dependency-injection (v2.8.18) 
    - Updating symfony/http-foundation (v2.8.17) to symfony/http-foundation (v2.8.18) 
    - Updating symfony/event-dispatcher (v2.8.17) to symfony/event-dispatcher (v2.8.18) 
    - Updating symfony/http-kernel (v2.8.17) to symfony/http-kernel (v2.8.18) 
    - Updating symfony/process (v2.8.17) to symfony/process (v2.8.18) 
    - Updating symfony/routing (v2.8.17) to symfony/routing (v2.8.18) 
    - Updating symfony/serializer (v2.8.17) to symfony/serializer (v2.8.18) 
    - Updating symfony/translation (v2.8.17) to symfony/translation (v2.8.18) 
    - Updating symfony/validator (v2.8.17) to symfony/validator (v2.8.18) 
    - Updating symfony/yaml (v2.8.17) to symfony/yaml (v2.8.18) 
    - Updating twig/twig (v1.31.0) to twig/twig (v1.33.0) 
    - Updating zendframework/zend-feed (2.7.0) to zendframework/zend-feed (2.8.0) 

しかし、何のパッケージが更新されません取得：

> composer update drupal/core --with-dependencies 
Gathering patches for root package. 
Dependency "asm89/stack-cors" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "composer/semver" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "doctrine/annotations" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "doctrine/common" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "easyrdf/easyrdf" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "egulias/email-validator" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "guzzlehttp/guzzle" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "masterminds/html5" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "paragonie/random_compat" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "stack/builder" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony-cmf/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/class-loader" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/dependency-injection" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/event-dispatcher" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/http-foundation" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/http-kernel" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/polyfill-iconv" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/process" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/psr-http-message-bridge" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/serializer" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/translation" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/validator" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "symfony/yaml" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "twig/twig" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "zendframework/zend-diactoros" is also a root requirement, but is not explicitly whitelisted. Ignoring. 
Dependency "zendframework/zend-feed" is also a root requirement, but is not explicitly whitelisted. Ignoring. 

私はドライランをしようとすると、正しく更新が必要なすべてのパッケージを表示するようです--with-dependencies - drupal/coreのすべての依存関係をホワイトリストに入れて、それらも更新されるべきではありませんか？

Answer 1

この原因は、Drupal（drupal/drupal）が具体的にはcore/composer.jsonをプロジェクト（ルート）composer.jsonにマージするためです。

"extra": { 
    "merge-plugin": { 
    "include": [ 
     "core/composer.json" 
    ], 
    "recurse": false, 
    "replace": false, 
    "merge-extra": false 
}, 

これは、その結果、ルートの依存関係として扱われるべきdrupal/core依存性を引き起こす「Xは、ルート要求が、明示的に無視する。ホワイトリストに登録されていません。」エラー。

回避策として、composer updateでフルプロジェクトを更新するか、composer.jsonファイルのマージセクションを無効にするかのいずれかです。