Composer包依赖解析异常：配置仓库仍访问Packagist

我在使用Composer解析包依赖时遇到问题：拥有alexisvs/multipass-second-testing-module和alexisvs/multipass-testing-module两个模块，前者依赖后者。为分开管理模块，我将前者的依赖从主composer.json移至独立的composer.modules.json，并通过wikimedia/composer-merge-plugin合并配置。

相关配置详情 #

主composer.json文件 #

{
    ...
    "extra": {
        "laravel": {
            "dont-discover": [
                "barryvdh/laravel-ide-helper"
            ]
        },
        "merge-plugin": {
            "include": [
                "composer.modules.json"
            ],
            "require": [
                "composer.modules.json"
            ],
            "recurse": true,
            "replace": false,
            "ignore-duplicates": false,
            "merge-dev": true,
            "merge-extra": true,
            "merge-extra-deep": false,
            "merge-replace": true,
            "merge-scripts": false
        }
    },
    "config": {
        "optimize-autoloader": true,
        "preferred-install": "dist",
        "sort-packages": true,
        "allow-plugins": {
            "pestphp/pest-plugin": true,
            "php-http/discovery": true,
            "wikimedia/composer-merge-plugin": true
        },
        "github-oauth": {
        }
    },
    "minimum-stability": "stable",
    "prefer-stable": true
}

composer.modules.json #

{
    "repositories": [
        {
            "type": "path",
            "url": "packages/alexisvs/multipass-second-testing-module",
            "options": {
                "symlink": true
            }
        }
    ],
    "require": {
        "alexisvs/multipass-second-testing-module": "^0.0.1"
    }
}

alexisvs/multipass-second-testing-module的composer.json #

{
    "name": "alexisvs/multipass-second-testing-module",
    "version": "0.0.1",
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/AlexisVS/multipass-testing-module"
        }
    ],
    "require": {
        ...
        "alexisvs/multipass-testing-module": "dev-main"
    },
    ...
    "config": {
        "sort-packages": true,
        "allow-plugins": {
            "pestphp/pest-plugin": true,
            "phpstan/extension-installer": true
        },
        "github-oauth": {
        }
    },
    "minimum-stability": "dev",
    "prefer-stable": true
}

alexisvs/multipass-testing-module的composer.json #

{
    "name": "alexisvs/multipass-testing-module",
    "version": "1.0.3",
    "config": {
        "sort-packages": true,
    },
   
    "minimum-stability": "dev",
    "prefer-stable": true
}

执行错误信息 #

执行composer update -vvv时出现如下错误：

Updating dependencies
Generating rules
Resolving dependencies through SAT
Looking at all rules.
Something's changed, looking at all rules again (pass #1)
Dependency resolution completed in 0.009 seconds
Downloading https://repo.packagist.org/p2/alexisvs/multipass-testing-module~dev.json
[404] https://repo.packagist.org/p2/alexisvs/multipass-testing-module~dev.json
Downloading https://packagist.org/providers/alexisvs/multipass-testing-module.json
[200] https://packagist.org/providers/alexisvs/multipass-testing-module.json
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires alexisvs/multipass-second-testing-module ^0.0.1 -> satisfiable by alexisvs/multipass-second-testing-module[0.0.1].
    - alexisvs/multipass-second-testing-module 0.0.1 requires alexisvs/multipass-testing-module dev-main -> could not be found in any version, there may be a typo in the package name.

Potential causes:
 - A typo in the package name
 - The package is not available in a stable-enough version according to your minimum-stability setting
   see <https://getcomposer.org/doc/04-schema.md#minimum-stability> for more details.
 - It's a private package and you forgot to add a custom repository to find it

Read <https://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.

我已在子模块中配置了该模块的仓库地址，为何Composer仍尝试访问packagist获取该包？

核心原因 #

Composer仅读取根项目的repositories配置，子包内的仓库配置不会被加载——这是Composer的设计逻辑，避免依赖链中的仓库配置污染整个项目。同时，根项目的minimum-stability设为stable，而你依赖的是dev-main分支，默认会被Composer拒绝安装。

解决步骤 #

1. 迁移子包仓库配置到根项目
   将alexisvs/multipass-testing-module的VCS仓库配置添加到根项目的composer.modules.json中：

   {
       "repositories": [
           {
               "type": "path",
               "url": "packages/alexisvs/multipass-second-testing-module",
               "options": {
                   "symlink": true
               }
           },
           {
               "type": "vcs",
               "url": "https://github.com/AlexisVS/multipass-testing-module"
           }
       ],
       "require": {
           "alexisvs/multipass-second-testing-module": "^0.0.1"
       }
   }
   

2. 调整根项目稳定性设置
   两种方式二选一：

   • 修改根composer.json的全局稳定性：

     "minimum-stability": "dev",
     "prefer-stable": true
     

   • 在根项目require中显式允许该包的不稳定版本：

     "require": {
         "alexisvs/multipass-testing-module": "dev-main@dev"
     }
     

3. 清理缓存并重新执行更新

   composer clear-cache
   composer update -vvv
   

内容的提问来源于stack exchange，提问作者Alexis Van San