Tests Drupal dependencies are correct.

DrupalDependenciesTest.php

  /**
   * Tests Drupal dependencies are correct.
   */
  public function testDrupalDependencies() {
    $excluded_packages = [
      'wikimedia/composer-merge-plugin',
      'ircmaxell/password-compat',
    ];
    $project_lock = json_decode(file_get_contents($this->root . '/composer.lock'), TRUE);
    // Drupal 8.6.9 lock file.
    $core_lock = json_decode(file_get_contents($this->root . '/tests/fixture/composer.lock'), TRUE);
    $core_lock_packages = array_merge($core_lock['packages'], $core_lock['packages-dev']);
    $project_lock_packages = array_merge($project_lock['packages'], $project_lock['packages-dev']);
    foreach ($core_lock_packages as $package) {
      if (!in_array($package['name'], $excluded_packages)) {
        $key = array_search($package['name'], array_column($project_lock_packages, 'name'));
        $this->assertFalse($key === FALSE, sprintf('%s package is missing', $package['name']));
        $this->assertSame($package['version'], $project_lock_packages[$key]['version'], sprintf('%s version required for %s package.', $package['version'], $package['name']));
      }
    }
  }