作曲家自定义存储库包不能拉依赖

Question

Running into an issue with composer. I have a main project that im working on with some some small libraries I built that I want to more easily share between my projects. They are nowhere near release ready, so I do't want to add them to packagist, but when I require 1 that requires another, it will error unless I ad that custom repository as well on my master composer.json

also, the tertiary requirement can not resolve packagist libraries

Your requirements could not be resolved to an installable set of packages.
 Problem 1
   - ethereal/simpleCache dev-master requires predis/predis ^1.1@dev -> no matching package found.
   - ethereal/simpleCache dev-master requires predis/predis ^1.1@dev -> no matching package found.
    - Installation request for ethereal/simplecache dev-master -> satisfiable by ethereal/simpleCache[dev-master].

Main Project composer.json:

{
"name": "ethereal/SimpleTable",
"type": "project",
"repositories": [
    {
        "type": "vcs",
        "url": "https://github.com/mathus13/SimpleConfig.git"
    }
],
"require": {
    "php": ">=5.3.9",
    "doctrine/dbal": "^2.6@dev",
    "ethereal/SimpleConfig": "dev-master"
},
"require-dev": {
    "phpunit/phpunit": "~4.8"
},
"autoload": {
    "psr-4": {
        "Ethereal\\": "lib"
    }
}
}

config library: when running composer update in SimpleTable, Simple Cache will not be included unless explicitly required in SimpleTable.

{
"name": "ethereal/SimpleConfig",
"type": "project",
"version": "0.0.1",
"repositories": [
    {
        "type": "vcs",
        "url": "https://github.com/mathus13/SimpleCache.git"
    }
],
"require": {
    "php": ">=5.3.9",
    "ethereal/SimpleCache": "dev-master"
},
"require-dev": {
    "phpunit/phpunit": "~4.8"
},
"autoload": {
    "psr-4": {
        "Ethereal\\": "lib"
    }
}
}

cache library: when running composer update in SimpleTable, predis can not be resolved.

{
"name": "ethereal/simpleCache",
"type": "project",
"version": "0.0.1",
"require": {
    "predis/predis": "^1.1@dev",
    "php": ">=5.3.9"
},
"require-dev": {
    "phpunit/phpunit": "~4.8"
},
"autoload": {
    "psr-4": {
        "Ethereal\\": "lib"
    }
}
}

Answer 1

ethereal/SimpleTable depends on ethereal/SimpleConfig in dev stability, which depends on ethereal/SimpleCache in dev stability, which depends on predis/predis in dev stability (version 1.1 hasn't been released yet).

Packages included into the main package cannot define any stability, the only stability allowed is the one in the main package. And that is "stable" by default.

You made ONE exception from this rule by depending on "dev-master" for SimpleConfig", but this is not inherited.

You have multiple solutions:

1. Tag your software. Tags declare it more stable than "dev", and it generally is a good idea to only use tagged software in production.
2. Include ALL your own packages that are needed in the main package, even if they are not directly used. This will add exceptions from the general stability for them, and allow Composer to resolve any sub dependencies.
3. You can add "minimum-stability":"dev" to the main composer.json, but this will also allow all other packages to be installed from a branch. Using branches however is a very bad thing, because you cannot easily go back to the version that was working before you did the update - the branch pointer moves only forward. Only tags will point to the same software forever.
4. Adding "prefer-stable":true" is some sort of workaround for the problem that 3 introduces for packages that are already available in a stable release version. However you still have the problem of not being able to go back to your own packages' earlier versions, because you are using a branch.

If you are still developing these packages, depending on branches may seem necessary. However, a good package will be able to be developed and tested standalone, with barely any foreign code present apart from interface definitions (which will be used to mock everything), so putting all code together into a mixture of repos with branches checked out usually is an invitation for writing code that isn't cleanly separated.

If any of these packages is already done (I'd say "good enough"), tag it and depend on that version instead of a branch. You can always release new versions if you find bugs or want to add new features.