I knew that Drush make files were being phased out, but I kept using them, because in my opinion Composer isn't the best package manager in the known universe. It updates too much or too little, has uninformative error messages, and takes a lot more ram than necessary. Don't get me wrong, I still used composer, but not for Drupal core updates, because those are more important and sometimes security releases.
But, in 8.4, Drush 9 is required, and in Drush 9 make files don't work at all.
My concern is this: I have some wildcards in my composer.json similar to the ones mentioned in this issue: https://www.drupal.org/node/2609568 which tell composer where to find my modules' composer.json files. Yet, when I run
composer update drupal/core --with-dependencies
Whether or not I run it --with-dependencies, it will always go into the merge-plugin include paths and update all of those packages as well. Now, if my site is out in production, I would like an easy way to update core and core's vendor files WITHOUT updating a bunch of contrib modules' libraries which I do not care about. What if core releases a security update? I want to be able to conveniently update core and only core quickly. With Drush make, this was simple.
Has anyone figured out a way to do this with composer?