[FIXED] Composer requirements could not be resolved using custom packages

Issue

I'm currently developing my own composer packages, but they failed trying to execute composer update.

This is my root composer.json:

{
    ...
    "repositories": {
        "bar": {
            "type": "path",
            "url": "packages/pinnokkio/bar",
            "options": {
                "symlink": true
             }
        }
    },
    "require": {
        "php": "^8.0",
        ...
        "pinnokkio/bar": "@dev"
    },
    ...
}

This means, package pinnokkio/bar should be installed. And package pinnokkio/bar requires pinnokkio/foo as a dependency.

composer.json of pinnokkio/bar:

{
    "name": "pinnokkio/bar",
    ...
    "repositories": {
        "foo": {
            "type": "path",
            "url": "../foo",
            "options": {
                "symlink": true
            }
        }
    },
    "require": {
        "pinnokkio/foo": "@dev"
    },
    ...
}

composer.json of pinnokkio/foo:

{
    "name": "pinnokkio/foo",
    "require": {
        "php": "^8.0"
    },
    ...
}

All in all, in my main composer.json, I'm going to require a package that requires pinnokkio/foo to run. And further upcoming packages all require pinnokkio/foo in order to run, but unfortunately, I'm getting this error trying to execute composer update. All packages are located in <root>/packages/:

 Problem 1
    - pinnokkio/bar[dev-feature-modules, dev-master] require pinnokkio/foo@dev -> could not be found in any version, there may be a typo in the package nam
e.
    - Root composer.json requires pinnokkio/bar@dev -> satisfiable by pinnokkio/bar[dev-feature-modules, dev-master].

Solution

The repositories key is only read on the root composer.json.

As explained on the docs:

Repositories are not resolved recursively. You can only add them to your main composer.json. Repository declarations of dependencies' composer.jsons are ignored.

Resolving repositories recursively would be problematic. If multiple packages declared different repositories that included the same package, how would composer know which to use?

Also, this would open the door for dependencies hijacking your system by providing alternate repositories for known packages, and you'd end up installing untrusted packages in your system.

If you are installing multiple packages from a custom repositories, all the custom repositories need to be declared on the root configuration file.

Answered By - yivi