Repository: composer/composer

Issue #5438: Update whitelisting does not correctly whitelist dependencies of new packages to be installed
Created: 2016-06-15T12:31:40Z
composer.json.1:
{
    "repositories": [
        {
            "packagist": false
        },
        {
            "type": "package",
            "package": {
                "name": "a/a",
                "version": "1.0.0",
                "type": "metapackage",
                "require": {
                    "a/b": "*"
                }
            }
        },
        {
            "type": "package",
            "package": {
                "name": "a/b",
                "version": "1.0.0",
                "type": "metapackage"
            }
        },
        {
            "type": "package",
            "package": {
                "name": "a/c",
                "version": "1.0.0",
                "type": "metapackage",
                "require": {
                    "a/b": "2.0.0"
                }
            }
        }
    ],
    "require": {
        "a/a": "1.0.0"
    }
}
composer.json.2:
{
    "repositories": [
        {
            "packagist": false
        },
        {
            "type": "package",
            "package": {
                "name": "a/a",
                "version": "1.0.0",
                "type": "metapackage",
                "require": {
                    "a/b": "*"
                }
            }
        },
        {
            "type": "package",
            "package": {
                "name": "a/b",
                "version": "1.0.0",
                "type": "metapackage"
            }
        },
        {
            "type": "package",
            "package": {
                "name": "a/b",
                "version": "2.0.0",
                "type": "metapackage"
            }
        },
        {
            "type": "package",
            "package": {
                "name": "a/c",
                "version": "1.0.0",
                "type": "metapackage",
                "require": {
                    "a/b": "2.0.0"
                }
            }
        }
    ],
    "require": {
        "a/a": "1.0.0",
        "a/c": "1.0.0"
    }
}
When I run this command:
COMPOSER=composer.json.1 composer update
COMPOSER=composer.json.2 composer update a/c --with-dependencies --dry-run

I get this output:
Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Can only install one of: a/b[2.0.0, 1.0.0].
    - Can only install one of: a/b[2.0.0, 1.0.0].
    - a/c 1.0.0 requires a/b 2.0.0 -> satisfiable by a/b[2.0.0].
    - Installation request for a/c 1.0.0 -> satisfiable by a/c[1.0.0].
    - Installation request for a/b (installed at 1.0.0) -> satisfiable by a/b[1.0.0].


And I expected this to happen:

a/b should be updated to 2.0
a/c 1.0 should be installed

Duplicate issue #7261: Can not require package, even with update-with-all-dependencies 
Created: 2018-04-13T07:55:02Z
My composer.json:
{
    "name": "neoacevedo/openbiblio2",
    "description": "Sistema automatizado de gestión bibliotecaria y OPAC.",
    "keywords": ["yii2", "opac", "openbiblio2", "online library project"],
    "homepage": "https://www.neoacevedo.co/openbiblio2",
    "type": "project",
    "license": "GPL-3.0-or-later",
    "support": {
        "issues": "https://github.com/neoacevedo/openbiblio2/issues",
        "forum": "https://www.neoacevedo.co/support",
        "source": "https://github.com/neoacevedo/openbiblio2"
    },
    "minimum-stability": "stable",
    "require": {
        "php": ">=7.0",
        "yiisoft/yii2": "~2.0.6",
        "yiisoft/yii2-bootstrap": "~2.0.0",
        "yiisoft/yii2-swiftmailer": "~2.0.0",
        "johnitvn/yii2-rbac-plus": "^1.0",
        "kartik-v/yii2-widget-sidenav": "*",
        "yiisoft/yii2-jui": "^2.0",
        "kartik-v/yii2-mpdf": "dev-master",
        "mpdf/mpdf": "^7.0",
        "kartik-v/yii2-export": "@dev"
    },
    "require-dev": {
        "yiisoft/yii2-debug": "~2.0.0",
        "yiisoft/yii2-gii": "~2.0.0",
        "yiisoft/yii2-faker": "~2.0.0",

        "codeception/base": "^2.2.3",
        "codeception/verify": "~0.3.1"
    },
    "config": {
        "process-timeout": 1800,
        "fxp-asset":{
            "installer-paths": {
                "npm-asset-library": "vendor/npm",
                "bower-asset-library": "vendor/bower"
            }
        }
    }
}
Output of composer diagnose:
Checking composer.json: WARNING
require.kartik-v/yii2-widget-sidenav : unbound version constraints (*) should be avoided
require.kartik-v/yii2-mpdf : unbound version constraints (dev-master) should be avoided
require.kartik-v/yii2-export : unbound version constraints (@dev) should be avoided
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com oauth access: OK
Checking disk free space: OK
Checking pubkeys: 
Tags Public Key Fingerprint: 57815BA2 7E54DC31 7ECC7CC5 573090D0  87719BA6 8F3BB723 4E5D42D0 84A14642
Dev Public Key Fingerprint: 4AC45767 E5EC2265 2F0C1167 CBBB8A2B  0C708369 153E328C AD90147D AFE50952
OK
Checking composer version: OK
Composer version: 1.6.3
PHP version: 7.1.9
PHP binary path: /usr/local/bin/php

When I run this command:
composer require yiisoft/yii2-apidoc:^2.1 --update-with-all-dependencies -vvv

I get the following output:
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Installation request for yiisoft/yii2-apidoc ^2.1 -> satisfiable by yiisoft/yii2-apidoc[2.1.0].
    - yiisoft/yii2-apidoc 2.1.0 requires cebe/markdown ~1.0.0 | ~1.1.0 -> satisfiable by cebe/markdown[1.0.0, 1.0.0-rc, 1.0.1, 1.0.2, 1.0.3, 1.0.x-dev, 1.1.0, 1.1.1, 1.1.2] but these conflict with your requirements or minimum-stability.
  Problem 2
    - yiisoft/yii2 2.0.15.1 requires cebe/markdown ~1.0.0 | ~1.1.0 -> satisfiable by cebe/markdown[1.0.0, 1.0.0-rc, 1.0.1, 1.0.2, 1.0.3, 1.0.x-dev, 1.1.0, 1.1.1, 1.1.2] but these conflict with your requirements or minimum-stability.
    - yiisoft/yii2 2.0.15.1 requires cebe/markdown ~1.0.0 | ~1.1.0 -> satisfiable by cebe/markdown[1.0.0, 1.0.0-rc, 1.0.1, 1.0.2, 1.0.3, 1.0.x-dev, 1.1.0, 1.1.1, 1.1.2] but these conflict with your requirements or minimum-stability.
    - yiisoft/yii2 2.0.15.1 requires cebe/markdown ~1.0.0 | ~1.1.0 -> satisfiable by cebe/markdown[1.0.0, 1.0.0-rc, 1.0.1, 1.0.2, 1.0.3, 1.0.x-dev, 1.1.0, 1.1.1, 1.1.2] but these conflict with your requirements or minimum-stability.
    - Installation request for yiisoft/yii2 (locked at 2.0.15.1, required as ~2.0.6) -> satisfiable by yiisoft/yii2[2.0.15.1].


Installation failed, reverting ./composer.json to its original content.

And I expected this to happen:
An update with all dependencies
Workaround:
  composer require yiisoft/yii2-apidoc:^2.1 --no-update
  composer update

Related issues:

yiisoft/yii2-apidoc#123
#6661 (comment)
#5362
#5438

Background:
When running a full update the package cebe/markdown is updated:
Installs: scrivo/highlight.php:v8.9.1, mikevanriel/text-to-latex:1.0.1, cebe/markdown-latex:1.1.4, cebe/js-search:0.9.3, nikic/php-parser:v1.4.1, phpdocumentor/reflection:3.0.1, bower-asset/jquery:3.2.1, bower-asset/yii2-pjax:2.0.7.1, bower-asset/punycode:v1.3.2, bower-asset/inputmask:3.3.11, bower-asset/bootstrap:v3.3.7, yiisoft/yii2-apidoc:2.1.0, bower-asset/typeahead.js:v0.11.1, bower-asset/jquery-ui:1.12.1, bower-asset/bootstrap3-dialog:v1.35.4
Updates: cebe/markdown:1.0.3, phpdocumentor/reflection-docblock:2.0.5
Removals: webmozart/assert, phpdocumentor/type-resolver, phpdocumentor/reflection-common
  - Removing webmozart/assert (1.3.0)
  - Removing phpdocumentor/type-resolver (0.4.0)
  - Removing phpdocumentor/reflection-common (1.0.1)
  - Installing scrivo/highlight.php (v8.9.1): Loading from cache
 Extracting archive    REASON: yiisoft/yii2-apidoc 2.1.0 requires scrivo/highlight.php ~8.0 -> satisfiable by scrivo/highlight.php[v8.0, v8.1, v8.2, v8.3, v8.4, v8.5, v8.6, v8.7, v8.8.0, v8.9.1].

  - Installing mikevanriel/text-to-latex (1.0.1): Loading from cache
 Extracting archive    REASON: cebe/markdown-latex 1.1.4 requires mikevanriel/text-to-latex ~1.0.0 -> satisfiable by mikevanriel/text-to-latex[1.0.0, 1.0.1].

  - Updating cebe/markdown (1.1.2 => 1.0.3): Loading from cache Extracting archive
    REASON: cebe/markdown-latex 1.1.4 requires cebe/markdown ~1.0.0 -> satisfiable by cebe/markdown[1.0.0, 1.0.1, 1.0.2, 1.0.3].

[...]

  - Updating phpdocumentor/reflection-docblock (4.3.0 => 2.0.5): Loading from cache Extracting archive
    REASON: phpdocumentor/reflection 3.0.1 requires phpdocumentor/reflection-docblock ~2.0 -> satisfiable by phpdocumentor/reflection-docblock[2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5].

[...]

Writing lock file
Generating autoload files

But it's a dependency of
root@0df0de4e0f4c:/app# composer why cebe/markdown
cebe/markdown-latex  1.1.4     requires  cebe/markdown (~1.0.0)           
yiisoft/yii2         2.0.13.1  requires  cebe/markdown (~1.0.0 | ~1.1.0)  
yiisoft/yii2-apidoc  2.1.0     requires  cebe/markdown (~1.0.0 | ~1.1.0)  

So it's a dependency of a root dependency, maybe that's the reason why it is not touched.
According to help:
--update-with-all-dependencies  Allows all inherited dependencies to be updated, including those that are root requirements.

That should actually be --update-with-root-dependencies (?) or is there also an option to allow a full update?

Closing comment (2019-01-30T15:34:17Z): Actually.. duplicate of #5438 (just saw now you referenced that issue) so closing. #5438 (comment) explains why this is complex.