composer update not pulling latest dev-master

Question

I've created two git repositories that we need to install in one of our web applications by using PHP's composer. There are two branches on each repository, master and dev-master.

Inside the project I want the package to install, I've created the following composer.json package configuration:

{     "name": "laravel/laravel",     "description": "The Laravel Framework.",     "keywords": ["framework", "laravel"],     "license": "proprietary",     "repositories": [         {             "type": "package",             "package": {                 "name": "impression-works/pdf-generator",                 "version": "dev-master",                 "source": {                     "url": "[email protected]:...",                     "type": "git",                     "reference": "dev-master"                 }             }         },         {             "type": "package",             "package": {                 "name": "impression-works/psd-templates",                 "version": "dev-master",                 "source": {                     "url": "[email protected]:...",                     "type": "git",                     "reference": "dev-master"                 }             }         }     ],     "require": {         // ...         "impression-works/psd-templates": "dev-master",         "impression-works/pdf-generator": "dev-master"     },     "autoload": {         // ...         "psr-0": {             "ImpressionWorks\\PsdTemplates": "vendor/impression-works/psd-templates/src",             "ImpressionWorks\\PdfGenerator": "vendor/impression-works/pdf-generator/src"         }     },     // ...     "config": {         "preferred-install": "dist"     },     "minimum-stability": "stable" } 

When I initially run composer update or composer install, the impression-works packages install perfectly, however, if I make changes to these repositories, and push them to dev-master, any successive calls to composer update simply reports:

Nothing to install or update 

How do I force composer to update to the latest commit on these two custom packages of ours?

Answer 1

I come to this page multiple times a week from a Google search, only to see that it doesn't answer my problem. So here goes.

I'm using packagist.org, not VCS. I do not want to use VCS as it slows Composer even more, and it's already painfully slow.

Consider the following scenario. Application in early development depends on a package I'm building. The package is also early in dev, so dev-master as version to get the latest master every time.

I fix a critical bug in the package, commit & push it, mash the update button in packagist.org, and then run composer update, and absolutely nothing happens.

$ composer update Loading composer repositories with package information Updating dependencies (including require-dev) Nothing to install or update Writing lock file Generating autoload files 

At this point you might try clearing the cache. It doesn't help.

Some point in time you'll stumble upon this open issue from 2012. After that you'll find out that the only way to get the latest version installed is to use the commit hash in the require.

---

composer require vendor/package dev-master#0d7d6c88

This requires that you manually get the commit hash and update the version to composer.json, and then run composer update again. Not exactly what you'd expect from a dependency manager. Looks like the issue is never going away, so unless someone writes a better Composer, we're stuck with this behavior.

The alternative is tagging every single commit that you want to download using Composer. Beware of confusing minimum stability rules & errors, which Composer throws by default.

Answer 2

You should rather use custom repositories of type VCS. The package repo you used has a few limitations as highlighted in the docs:

• Composer will not update the package unless you change the version field.
• Composer will not update the commit references, so if you use master as reference you will have to delete the package to force an update, and will have to deal with an unstable lock file.