Running 'composer update' replaces module folders I'm going through the nightmare of trying to update a site to 8.4.4 from 8.3.2. It seems like the best way forward is to delete vendors and composer.lock and let composer replace everything. However, when I do this, it also goes through and replaces all of my module folders as well. A number of them are patched, so replacing them straight out of the gate simply doesn't work.

Is this normal behavior for composer? Is there some way to specify that I only want to replace what's going into the vendor directory?
Is this normal behavior for composer?


Yes


  Is there some way to specify that I only want to replace what's going into the vendor directory?


Sure, remove the reference to the module(s) from composer.json. Obviously at that point you’ll need to manage any updates for them yourself.

A better resolution would be to install Composer patches, and patch the modules automatically as they’re being installed/updated.