How do I update without using the parameter --with-dependencies in "composer update --with-dependencies"?

Question

I just finished my first Drupal 8 project, and I want to have it up-to-date before submitting it to the remote server. I read that it's better not to use composer update --with-dependencies. I understand why this is. I will do this for the core and modules, so I updated core with composer update drupal/core --with-dependencies and one drupal/module but then when I run composer outdated I still see a large list of symfony/twig/phpunit/zendframework/and more.

Do I really need to update them one by one? It seems a lot of work to do this every time. There are maybe 30 or 40 to update.

Hope someone can explain me how this works.

Answer 1

I just use composer update --no-dev from the directory containing the composer.json file and the core directory, and I get all updated.

Loading composer repositories with package information
Updating dependencies
Package operations: 0 installs, 21 updates, 0 removals
  - Updating twig/twig (v1.33.2 => v1.34.3): Loading from cache
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/yaml (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/polyfill-mbstring (v1.3.0 => v1.4.0): Loading from cache
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/translation (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/validator (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/polyfill-php55 (v1.3.0 => v1.4.0): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/serializer (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/routing (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/polyfill-php54 (v1.3.0 => v1.4.0): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/http-foundation (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/process (v2.8.21 => v2.8.22): Loading from cache
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/polyfill-iconv (v1.3.0 => v1.4.0): Loading from cache
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/event-dispatcher (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/debug (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/http-kernel (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/dependency-injection (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/console (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/polyfill-apcu (v1.3.0 => v1.4.0): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating symfony/class-loader (v2.8.21 => v2.8.22): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating guzzlehttp/guzzle (6.2.3 => 6.3.0): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
  - Updating drupal/core (8.3.2 => 8.3.4): Downloading (100%)
> Drupal\Core\Composer\Composer::vendorTestCodeCleanup
Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess

I put drupal/core in the require section, so it gets updated too.

As for the output of composer outdated, I get the following.

doctrine/annotations            v1.2.7      v1.4.0      Docblock Annotations Parser
egulias/email-validator         1.2.14      2.1.2       A library for validating emails
symfony-cmf/routing             1.4.1       2.0.1       Extends the Symfony2 routing component for dynamic routes and chaining sever...
symfony/class-loader            v2.8.22     v3.3.2      Symfony ClassLoader Component
symfony/console                 v2.8.22     v3.3.2      Symfony Console Component
symfony/debug                   v2.8.22     v3.3.2      Symfony Debug Component
symfony/dependency-injection    v2.8.22     v3.3.2      Symfony DependencyInjection Component
symfony/event-dispatcher        v2.8.22     v3.3.2      Symfony EventDispatcher Component
symfony/http-foundation         v2.8.22     v3.3.2      Symfony HttpFoundation Component
symfony/http-kernel             v2.8.22     v3.3.2      Symfony HttpKernel Component
symfony/process                 v2.8.22     v3.3.2      Symfony Process Component
symfony/routing                 v2.8.22     v3.3.2      Symfony Routing Component
symfony/serializer              v2.8.22     v3.3.2      Symfony Serializer Component
symfony/translation             v2.8.22     v3.3.2      Symfony Translation Component
symfony/validator               v2.8.22     v3.3.2      Symfony Validator Component
symfony/yaml                    v2.8.22     v3.3.2      Symfony Yaml Component
twig/twig                       v1.34.3     v2.4.3      Twig, the flexible, fast, and secure template language for PHP

That is normal, though, since the core/composer.json file has some restrictions for the package versions that don't allow to update to the versions shown from composer outdated. For example, see the following lines in core/composer.json.

"doctrine/annotations": "1.2.*",
"egulias/email-validator": "1.2.*"

1.2.* is telling Composer that any version greater or equal to 1.2.0 and lower than 1.3 are acceptable. doctrine/annotations version 1.4.0 falls outside that range.