How to correctly require a specific commit in Composer so that it would be available for dependent packages?

Question

You'll have to explicitly require the Gaufrette library at that hash, with a dev flag, in both your library and your application. Something like this should work in the application composer.json:

{
    "name": "bar/bar-app",
    "repositories": [
        {
            "type": "vcs",
            "url": "ssh://git.example.com/foo-lib"
        }
    ],
    "require-dev": {
        "foo/foo-lib": "dev-master",
        "knplabs/gaufrette": "dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e"
    }
}

From the documentation:

If one of your dependencies has a dependency on an unstable package you need to explicitly require it as well, along with its sufficient stability flag.

The documentation also suggests that you'll need to include the repository for Gaufrette in your bar/bar-app Composer file, though it sounds like this wasn't necessary in this case. I'm not sure why.

Here is how you do it on the command line:

composer update knplabs/gaufrette:dev-master#2633721 --with-dependencies

You don't have to use the whole hash, a hash seven characters long seems to dothe trick. As mentioned above, your project will need to support dev - which it will complain about if not already set. Also, use --with-dependencies to get any dependencies of the one you are updating.

If you're making changes for a Git Repository by forking make sure that you use the The package name is actually defined in the package's own composer.json file - so even though I'd forked the package to my own joshuapaling github account, and the package was now residing at the URL https://github.com/joshuapaling/Cake-Resque.git, that had not influenced the package's name at all, from composers perspective.

A stupid error - but I'm new to composer, and it wasn't clear at first! So, I hope this helps someone else with the same problem.