Does Composer prioritise private packages' requirements?

1
votes

I have a project where composer is used to install Nette Framework and one private package hosted in private composer repository.

Project's composer.json:

...
"require": {
    "php": ">= 5.3.7",
    "nette/nette": "2.1.*",
    "myrepo/private-package": "*"
},
"minimum-stability": "dev",
"repositories": [
    {
        "type": "composer",
        "url": "http://myrepo.org"
    }
]
...

Private package's composer.json:

...
"require": {
         "php": ">= 5.3.7",
         "nette/nette": "2.2.*"
},
...

As you can see the project requires Nette 2.1.*. The Private package, however, requires Nette on version 2.2.*.

If I run composer install, Composer installs 2.2.* version of Nette. That doesn't comply the project's composer.json (which requires 2.1.*).

I understand both requirments can't be fulfilled. But why composer doesn't print out an error then? Do private repositories have some kind of priority?

1
phpcomposer-php
Are you sure that you are installing the most recent commit of "dev-master"? That branch once was version 2.1.x, and if your local composer.lock references a commit from the pre-2.2 development times, the version requirement would be fulfilled without complaint. But again this is another example of why using branches in Composer is not the best idea. – Sven
Indeed it is the most recent commit. I always delete composer.lock, the whole vendor folder and composer's cache, but this still happens. – tsusanka
Btw if I change the second requirment to 2.2.* it is still used instead of the project's 2.1.*. I'll edit the question accordingly, it's better example than with dev-master. – tsusanka

1 Answers

1
votes

This was a bug and is now fixed.