--TEST-- See Github issue #4795 ( github.com/composer/composer/issues/4795 ). Composer\Installer::whitelistUpdateDependencies intentionally ignores root requirements even if said package is also a dependency of one the requirements that is whitelisted for update. --COMPOSER-- { "repositories": [ { "type": "package", "package": [ { "name": "a/a", "version": "1.0.0" }, { "name": "a/a", "version": "1.1.0" }, { "name": "b/b", "version": "1.0.0", "require": { "a/a": "~1.0" } }, { "name": "b/b", "version": "1.1.0", "require": { "a/b": "~1.1" } } ] } ], "require": { "a/a": "~1.0", "b/b": "~1.0" } } --INSTALLED-- [ { "name": "a/a", "version": "1.0.0" }, { "name": "b/b", "version": "1.0.0", "require": { "a/a": "~1.0" } } ] --LOCK-- { "packages": [ { "name": "a/a", "version": "1.0.0" }, { "name": "b/b", "version": "1.0.0", "require": { "a/a": "~1.0" } } ], "packages-dev": [], "aliases": [], "minimum-stability": "dev", "stability-flags": [], "prefer-stable": false, "prefer-lowest": false, "platform": [], "platform-dev": [] } --RUN-- update b/b --with-dependencies --EXPECT-OUTPUT-- Dependency "a/a" is also a root requirement, but is not explicitly whitelisted. Ignoring. Loading composer repositories with package information Updating dependencies Nothing to install or update Writing lock file Generating autoload files --EXPECT--