This may have to be a false, but it should be evaluated after the whitelist is generated I think. As it is, if you request the installation of symfony/process, it wouldn't be resolvable by installing symfony/symfony anymore - do we not have a test for that case?