Issue #3198340 by alexpott, xjm, cilefen, Mile23, mmjvb, catch, longwave, mfb,...

Issue #3198340 by alexpott, xjm, cilefen, Mile23, mmjvb, catch, longwave, mfb, Mixologic, effulgentsia, larowlan, Warped, quietone, greg.1.anderson: Strict constraints in drupal/core-recommended make it harder for Composer-managed sites to apply their own security updates when a core update is not available