I'm going through the nightmare of trying to update a site to 8.4.4 from 8.3.2. It seems like the best way forward is to delete
composer.lock and let composer replace everything. However, when I do this, it also goes through and replaces all of my module folders as well. A number of them are patched, so replacing them straight out of the gate simply doesn't work.
Is this normal behavior for composer? Is there some way to specify that I only want to replace what's going into the vendor directory?