Skip dependency packages required in composer.json in update whitelist

src/Composer/Installer.php

@@ -220,7 +220,11 @@ class Installer
             $stabilityFlags = $this->locker->getStabilityFlags();
         }
 
-        $this->whitelistUpdateDependencies($localRepo, $devMode);
+        $this->whitelistUpdateDependencies(
+            $localRepo,
+            $devMode,
+            $this->package->getRequires(),
+            $this->package->getDevRequires());
 
         // creating repository pool
         $pool = new Pool($minimumStability, $stabilityFlags);
@@ -464,15 +468,30 @@ class Installer
     /**
      * Adds all dependencies of the update whitelist to the whitelist, too.
      *
+     * Packages which are listed as requirements in the root package will be
+     * skipped including their dependencies, unless they are listed in the
+     * update whitelist themselves.
+     *
      * @param RepositoryInterface $localRepo
      * @param boolean $devMode
+     * @param array $rootRequires An array of links to packages in require of the root package
+     * @param array $rootDevRequires An array of links to packages in require-dev of the root package
      */
-    private function whitelistUpdateDependencies($localRepo, $devMode)
+    private function whitelistUpdateDependencies($localRepo, $devMode, array $rootRequires, array $rootDevRequires)
     {
         if (!$this->updateWhitelist) {
             return;
         }
 
+        if ($devMode) {
+            $rootRequires = array_merge($rootRequires, $rootDevRequires);
+        }
+
+        $skipPackages = array();
+        foreach ($rootRequires as $require) {
+            $skipPackages[$require->getTarget()] = true;
+        }
+
         $pool = new Pool;
         $pool->addRepository($localRepo);
 
@@ -503,6 +522,9 @@ class Installer
                     $requirePackages = $pool->whatProvides($require->getTarget());
 
                     foreach ($requirePackages as $requirePackage) {
+                        if (isset($skipPackages[$requirePackage->getName()])) {
+                            continue;
+                        }
                         $packageQueue->enqueue($requirePackage);
                     }
                 }

tests/Composer/Test/Fixtures/installer/update-whitelist-locked-require.test

@@ -24,7 +24,7 @@ Update with a package whitelist only updates those packages and their dependenci
 }
 --INSTALLED--
 [
-    { "name": "whitelisted", "version": "1.0.0", "require": { "dependency": "1.0.0", "fixed-dependency": "1.0.0" } },
+    { "name": "whitelisted", "version": "1.0.0", "require": { "dependency": "1.0.0", "fixed-dependency": "1.*" } },
     { "name": "dependency", "version": "1.0.0" },
     { "name": "fixed-dependency", "version": "1.0.0", "require": { "fixed-sub-dependency": "1.*" } },
     { "name": "fixed-sub-dependency", "version": "1.0.0" }