composer update package/name --with-dependencies not whitelisting dependencies

Question

I'm trying to update only a single package and its dependencies. When I try a dry-run, it correctly seems to list all the packages that need updating:

> composer update drupal/core --with-dependencies --dry-run
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 17 updates, 0 removals
  - Updating guzzlehttp/psr7 (1.3.1) to guzzlehttp/psr7 (1.4.2)
  - Updating guzzlehttp/guzzle (6.2.2) to guzzlehttp/guzzle (6.2.3)
  - Updating symfony/class-loader (v2.8.17) to symfony/class-loader (v2.8.18)
  - Updating symfony/debug (v2.8.17) to symfony/debug (v2.8.18)
  - Updating symfony/console (v2.8.17) to symfony/console (v2.8.18)
  - Updating symfony/dependency-injection (v2.8.17) to symfony/dependency-injection (v2.8.18)
  - Updating symfony/http-foundation (v2.8.17) to symfony/http-foundation (v2.8.18)
  - Updating symfony/event-dispatcher (v2.8.17) to symfony/event-dispatcher (v2.8.18)
  - Updating symfony/http-kernel (v2.8.17) to symfony/http-kernel (v2.8.18)
  - Updating symfony/process (v2.8.17) to symfony/process (v2.8.18)
  - Updating symfony/routing (v2.8.17) to symfony/routing (v2.8.18)
  - Updating symfony/serializer (v2.8.17) to symfony/serializer (v2.8.18)
  - Updating symfony/translation (v2.8.17) to symfony/translation (v2.8.18)
  - Updating symfony/validator (v2.8.17) to symfony/validator (v2.8.18)
  - Updating symfony/yaml (v2.8.17) to symfony/yaml (v2.8.18)
  - Updating twig/twig (v1.31.0) to twig/twig (v1.33.0)
  - Updating zendframework/zend-feed (2.7.0) to zendframework/zend-feed (2.8.0)

However, when I run the same command without --dry-run, no packages get updated:

> composer update drupal/core --with-dependencies
Gathering patches for root package.
Dependency "asm89/stack-cors" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "composer/semver" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "doctrine/annotations" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "doctrine/common" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "easyrdf/easyrdf" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "egulias/email-validator" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "guzzlehttp/guzzle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "masterminds/html5" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "paragonie/random_compat" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "stack/builder" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony-cmf/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/class-loader" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/dependency-injection" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/event-dispatcher" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/http-foundation" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/http-kernel" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/polyfill-iconv" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/process" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/psr-http-message-bridge" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/routing" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/serializer" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/translation" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/validator" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/yaml" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "twig/twig" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "zendframework/zend-diactoros" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "zendframework/zend-feed" is also a root requirement, but is not explicitly whitelisted. Ignoring.

Shouldn't the --with-dependencies-switch whitelist all dependencies of drupal/core, causing those to be updated as well?

Answer 1

The cause of this is that Drupal (drupal/drupal) specifically merges core/composer.json into the project (root) composer.json.

"extra": {
  "merge-plugin": {
    "include": [
      "core/composer.json"
    ],
    "recurse": false,
    "replace": false,
    "merge-extra": false
},

This causes the drupal/core dependencies to be treated as root dependencies, resulting in the "X is also a root requirement, but is not explicitly whitelisted. Ignoring." errors.

As a workaround, either update the full project via composer update or disable the merge section of your composer.json file.