How do debug decisions made by composer update (-w/-W)

[mxr576]

Is there a way to debug decisions made by composer update (-w/-W)? It keeps updating packages and even if I think I understand how -w/-W suppose to work, I do not understand why it updates some packages on a project.

Also, am I the only one who does not understand why Composer (2) updates packages? (Am I the only one who is concerned by unexpected package updates? :P )

Composer version: 2.1.6

[mxr576]

I was curious so I checked if the same happens with Composer 1. I did not understand why apigee/apigee-client-php gets updated with -w and -W. Interestingly, Composer 1 does not want to update that package on the same project (and yes, Composer 1 still has access to the latest releases of that package, see output.).

composer1.txt
composer2.txt

Unfortunately, the project is internal, packages are internal, so I cannot share that. Not sure how much time would it take to create a minimum code where that can be reproduced... so if you experience the same and you can share a project where it happens, please share it here.

[stof]

@mxr576 as path repositories are symlinking the code, the content of the package is actually already updating even without running a composer update at all. Updating them on each update even when not whitelisted explicitly was a way to use the right package metadata (list of dependencies, autoloading rules) corresponding to that source code at least when you run a composer update.

@Seldaek maybe this forced inclusion of path packages should be done after building the whitelist with -w/-W, so that the path packages don't automatically whitelist their dependencies when this option are used (they would still whitelist their dependencies if the path packages are explicitly marked for update in the whitelist in the command)

[mxr576]

maybe this forced inclusion of path packages should be done after building the whitelist with -w/-W, so that the path packages don't automatically whitelist their dependencies when this option is used (they would still whitelist their dependencies if the path packages are explicitly marked for update in the whitelist in the command)

➕ on this, should we open a new issue about this?

[stof]

@mxr576 that makes sense

[Seldaek]

See #10157

[mxr576]

thanks @Seldaek, this was still in my todo list

[mxr576]

I consider this as resolved.

#10093 (reply in thread) solves my original problem and it seems the answer to my original question is: there is no way to debug it.