Specifying specific commit in update fails to update.

[Danack]

TL:DR specifying specific sha on update fails to update the dependency to that version.

My composer.json:

{
    "name": "test/test",
    "description": "testing update",
    "type": "project",
    "require": {
        "phpopendocs/blank-project": "dev-main#2992e294e113aee9e144f468c4a44563bf25d0be"
    },
    "license": "MIT",
    "minimum-stability": "dev"
}

Output of composer diagnose:

# php composer.phar diagnose
Checking composer.json: WARNING
The package "phpopendocs/blank-project" is pointing to a commit-ref, this is bad practice and can cause unforeseen issues.
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com rate limit: OK
Checking disk free space: OK
Checking pubkeys: FAIL
Missing pubkey for tags verification
Missing pubkey for dev verification
Run composer self-update --update-keys to set them up
Checking composer version: OK
Composer version: 2.0.12
PHP version: 7.4.16
PHP binary path: /usr/bin/php7.4
OpenSSL version: OpenSSL 1.1.1j  16 Feb 2021
cURL version: 7.52.1 libz 1.2.8 ssl OpenSSL/1.0.2u
zip: extension present, unzip not available

running composer update installs the version dev-main#2992e294e113aee9e144f468c4a44563bf25d0be as expected.

When I run this command:

php composer.phar update phpopendocs/blank-project=dev-main#301a83b393cb268e38b683b104ed323a38a42097 --no-cache -vvv

I get the following output:

# php composer.phar update phpopendocs/blank-project=dev-main#301a83b393cb268e38b683b104ed323a38a42097 --no-cache -vvv
Disabling cache usage
Reading ./composer.json (/var/app/temp/composer.json)
Loading config file ./composer.json (/var/app/temp/composer.json)
Checked CA file /etc/ssl/certs/ca-certificates.crt: valid
Executing command (/var/app/temp): git branch -a --no-color --no-abbrev -v
Failed to initialize global composer: Composer could not find the config file: /root/.config/composer/composer.json

Reading /var/app/temp/vendor/composer/installed.json
Running 2.0.12 (2021-04-01 10:14:59) with PHP 7.4.16 on Linux / 5.4.72-microsoft-standard-WSL2
Reading ./composer.lock (/var/app/temp/composer.lock)
Loading composer repositories with package information
Downloading https://repo.packagist.org/packages.json
[200] https://repo.packagist.org/packages.json
Downloading https://repo.packagist.org/p2/phpopendocs/blank-project.json
Downloading https://repo.packagist.org/p2/phpopendocs/blank-project~dev.json
[200] https://repo.packagist.org/p2/phpopendocs/blank-project.json
[200] https://repo.packagist.org/p2/phpopendocs/blank-project~dev.json
Updating dependencies
Generating rules
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.001 seconds
Analyzed 78 packages to resolve dependencies
Analyzed 79 rules to resolve dependencies
Nothing to modify in lock file
Installing dependencies from lock file (including require-dev)
Nothing to install, update or remove
Generating autoload files
1 package you are using is looking for funding.
Use the `composer fund` command to find out more!

The exit code is 0 indicating no error:

# echo $?
0

And I expected this to happen:

• The commit with sha 301a83b393cb268e38b683b104ed323a38a42097 to be installed.
• An error message about "unknown version" and error exit code if the update command doesn't result in the specified version being installed.

In case it is of use, here is the composer lock file:

# cat composer.lock
{
    "_readme": [
        "This file locks the dependencies of your project to a known state",
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
    "content-hash": "2b288f00ec34428356add44468def9bd",
    "packages": [
        {
            "name": "phpopendocs/blank-project",
            "version": "dev-main",
            "source": {
                "type": "git",
                "url": "https://github.com/PHPOpenDocs/BlankProject.git",
                "reference": "2992e294e113aee9e144f468c4a44563bf25d0be"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/PHPOpenDocs/BlankProject/zipball/2992e294e113aee9e144f468c4a44563bf25d0be",
                "reference": "2992e294e113aee9e144f468c4a44563bf25d0be",
                "shasum": ""
            },
            "require-dev": {
                "danack/coding-standard": "0.1.0",
                "slevomat/coding-standard": "^4.8.4",
                "squizlabs/php_codesniffer": "^3.3.1",
                "yoast/yoastcs": "1.0"
            },
            "default-branch": true,
            "type": "library",
            "autoload": {
                "psr-0": {
                    "Blank\\": "src/"
                },
                "files": [
                    "src/functions.php"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "CC-BY-NC-4.0"
            ],
            "authors": [
                {
                    "name": "Danack",
                    "email": "danack@basereality.com"
                }
            ],
            "description": "A blank PHPOpenDoc project.",
            "support": {
                "issues": "https://github.com/PHPOpenDocs/BlankProject/issues",
                "source": "https://github.com/PHPOpenDocs/BlankProject/tree/main"
            },
            "funding": [
                {
                    "url": "https://github.com/Danack",
                    "type": "github"
                }
            ],
            "time": "2021-04-24T16:41:28+00:00"
        }
    ],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "dev",
    "stability-flags": {
        "phpopendocs/blank-project": 20
    },
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": [],
    "platform-dev": [],
    "plugin-api-version": "2.0.0"
}

Also btw, updating the composer.json to reference "phpopendocs/blank-project": "dev-main#301a83b393cb268e38b683b104ed323a38a42097" correctly installs that version, so composer is able to find that version.

[Seldaek]

Hm yeah I think that's an oversight of the inline-require-modification feature, that these #commit-ref references are not taken into account as being valid root package references. Should be fixable though.