Restrict Composer dependency updates to only patch releases

I was doing website maintenance and checked for outdated dependencies with composer outdated . I usually filter with -D for checking direct dependencies and -p for packages with patch releases. These are typically easy pickings. I saw I was on 2.1.3 of the Honeypot module and 2.1.4 was available. So I ran composer update drupal/honeypot . I noticed the module was updated to 2.2.0 , because my…