composer-php - Composer 更新包/名称 --with-dependencies 不将依赖项列入白名单

Question

我试图仅更新一个包及其依赖项。当我尝试试运行时，它似乎正确地列出了所有需要更新的包:

> composer update drupal/core --with-dependencies --dry-run
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 17 updates, 0 removals
  - Updating guzzlehttp/psr7 (1.3.1) to guzzlehttp/psr7 (1.4.2)
  - Updating guzzlehttp/guzzle (6.2.2) to guzzlehttp/guzzle (6.2.3)
  - Updating symfony/class-loader (v2.8.17) to symfony/class-loader (v2.8.18)
  - Updating symfony/debug (v2.8.17) to symfony/debug (v2.8.18)
  - Updating symfony/console (v2.8.17) to symfony/console (v2.8.18)
  - Updating symfony/dependency-injection (v2.8.17) to symfony/dependency-injection (v2.8.18)
  - Updating symfony/http-foundation (v2.8.17) to symfony/http-foundation (v2.8.18)
  - Updating symfony/event-dispatcher (v2.8.17) to symfony/event-dispatcher (v2.8.18)
  - Updating symfony/http-kernel (v2.8.17) to symfony/http-kernel (v2.8.18)
  - Updating symfony/process (v2.8.17) to symfony/process (v2.8.18)
  - Updating symfony/routing (v2.8.17) to symfony/routing (v2.8.18)
  - Updating symfony/serializer (v2.8.17) to symfony/serializer (v2.8.18)
  - Updating symfony/translation (v2.8.17) to symfony/translation (v2.8.18)
  - Updating symfony/validator (v2.8.17) to symfony/validator (v2.8.18)
  - Updating symfony/yaml (v2.8.17) to symfony/yaml (v2.8.18)
  - Updating twig/twig (v1.31.0) to twig/twig (v1.33.0)
  - Updating zendframework/zend-feed (2.7.0) to zendframework/zend-feed (2.8.0)

但是，当我在没有 --dry-run 的情况下运行相同的命令时，没有包得到更新:

> composer update drupal/core --with-dependencies
Gathering patches for root package.
Dependency "asm89/stack-cors" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "composer/semver" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "doctrine/annotations" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "doctrine/common" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "easyrdf/easyrdf" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "egulias/email-validator" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "guzzlehttp/guzzle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "masterminds/html5" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "paragonie/random_compat" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "stack/builder" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony-cmf/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/class-loader" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/dependency-injection" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/event-dispatcher" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/http-foundation" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/http-kernel" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/polyfill-iconv" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/process" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/psr-http-message-bridge" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/serializer" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/translation" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/validator" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/yaml" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "twig/twig" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "zendframework/zend-diactoros" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "zendframework/zend-feed" is also a root requirement, but is not explicitly whitelisted. Ignoring.

--with-dependencies-switch 不应该将 drupal/core 的所有依赖项列入白名单，从而导致这些依赖项也被更新吗？

Answer 1

造成这种情况的原因是 Drupal (drupal/drupal) 专门将 core/composer.json 合并到项目(根)composer.json 。

"extra": {
  "merge-plugin": {
    "include": [
      "core/composer.json"
    ],
    "recurse": false,
    "replace": false,
    "merge-extra": false
},

这会导致 drupal/core 依赖项被视为根依赖项，从而导致“X 也是根依赖项，但未明确列入白名单。忽略。”错误。

作为解决方法，可以通过 composer update 更新整个项目，或者禁用 composer.json 文件的合并部分。