Composer: Package that extends another from a fork

Question

I've the following situation: There is package author/package1 on GitHub and Packagist. I decided to fork it into tcb13/package1 to add some code (that will eventually get merged into the original project, however it will take time).

Later on, I developed another package, tcb13/package1-extension that extends the fork tcb13/package1 by inhering some of it's methods into new classes...

At my tcb13/package1-extension , composer.json I wrote:

{
    "name": "tcb13/package1-extension",
    "description": "...",
    "keywords": [

    ],
    "homepage": "https://github.com/tcb13/package1-extension",
    "license": "MIT",
    "authors": [

    ],
    "repositories":
    [
        {
            "type": "vcs",
            "url": "https://github.com/tcb13/package1/"
        }
    ],
    "require": {
        "author/package1": "dev-master"
    },

I told composer that my extension package needs author/package1 and also there was an aditional repository https://github.com/tcb13/package1/ and set the package version to dev-master so composer would download author/package1 from my modified fork, instead of the original package... (it wouldn't work if I told it to download from tcb13/package1 ).

I submitted the code above to GitHub and tried to require tcb13/package1-extension on a new project, and composer said this:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Installation request for tcb13/package1-extension dev-master -> satisfiable by tcb13/package1-extension[dev-master].
    -  tcb13/package1-extension dev-master requires `author/package1` dev-master -> no matching package found.

Why the error? When I was developing my extension package I was able to require author/package1 as dev-master because it was pointed to my fork repo, however when I try require tcb13/package1-extension it seems like it doesn't look for my fork and tries to go to the original project looking for the branch... Why?

Also, is this the way I should use forks as dependencies? Is there other way? I originally tried to require the fork as tcb13/package1 but it would fail, however requiring it as author/package1 also telling composer I had a extra repository worked until now.

Thank you.

Answer 1

I managed to this fix. According to composer docs, this is not an error, it's something that happens by design due to security.

From a GitHub comment :

Consider this: you have a project that depends on one of my packages. I depend on a package that is critical to your application. I happen to make a fork to introduce a new feature and accidentally tag a release with the repository in my composer.json. You happen to update your package and get my fork that is potentially broken and definitely not what you were expecting when you defined your package dependency.

In order to be able to do what I want, I had to manually add to my final project tcb13/final-project the URL of the fork of author/package1 (the same way I did on tcb13/package1-extension ), like:

{
    "repositories":
    [
        {
            "type": "vcs",
            "url": "https://github.com/tcb13/package1/" // Fork of author/package1
        },
        {
            "type": "vcs",
            "url": "https://github.com/tcb13/package1-extension"
        }
    ],
    "require": {
        "author/package1": "dev-master", // Reference to the original package, composer will fetch this from my fork defined above...
        "tcb13/package1-extension": "dev-master" // My current extension package
    }
}

After composer update it all worked as expected.