[FIXED] How can I have Composer prefer stable releases, but grab a few select dev releases?

Issue

What I want to do

I'm trying to manage Drupal 8 and its modules using Composer. Here's what I want to do:

• Use the most recent stable version of modules/libraries whenever possible, except in a few cases where I explicitly declare otherwise.

(Why? Because occasionally the stable release of a Drupal module is broken but it's fixed in dev, so I need the dev version in those cases only until a new release is made.)

Here is an example of my composer.json:

  "require": {
    "composer/installers": "^1.0.21@stable",
    "wikimedia/composer-merge-plugin": "~1.3@stable",
    "cweagans/composer-patches": "~1.0@stable",
    "behat/mink-selenium2-driver": "^1.3@stable",
    "drupal/drupal-extension": "^3.1@stable",
    "drupal/bootstrap": "8.3.*@dev",
    "drupal/address": ">=8.1.0-beta2@beta",
    "drupal/advagg": ">=8.2.0-beta2@beta",
  },
  "replace": {
    "drupal/core": "~8.0"
  },
  "minimum-stability": "dev",
  "prefer-stable": true,

I want the dev version of Bootstrap ("drupal/bootstrap": "8.3.*@dev"), but because I have set prefer-stable: true, then I get the latest Bootstrap alpha, not the dev release.

If I set prefer-stable: false, then all the dependencies get switched to dev versions (Symfony, Twig, and so on).

I read this article on Composer versioning, but I couldn't find the solution to my problem.

EDIT: Note that this composer.json requires the Drupal packagist repository:

  "repositories": [
    {
      "type": "composer",
      "url": "https://packagist.drupal-composer.org"
    }
  ],

Here is the full composer.json:

{
  "name": "drupal/drupal",
  "description": "Drupal is an open source content management platform powering millions of websites and applications.",
  "type": "project",
  "license": "GPL-2.0+",
  "version": "8.0.3",
  "repositories": [
    {
      "type": "composer",
      "url": "https://packagist.drupal-composer.org"
    }
  ],
  "require": {
    "composer/installers": "^1.0.21",
    "wikimedia/composer-merge-plugin": "~1.3",
    "cweagans/composer-patches": "~1.0",
    "behat/mink-selenium2-driver": "^1.3",
    "drupal/drupal-extension": "^3.1",
    "drupal/address": "8.1.0-beta2",
    "drupal/advagg": "8.2.0-beta2",
    "drupal/bootstrap": "8.3.*@dev"
  },
  "replace": {
    "drupal/core": "~8.0"
  },
  "minimum-stability": "dev",
  "prefer-stable": true,
  "config": {
    "preferred-install": "dist",
    "autoloader-suffix": "Drupal8"
  },
  "extra": {
    "_readme": [
      "By default Drupal loads the autoloader from ./vendor/autoload.php.",
      "To change the autoloader you can edit ./autoload.php."
    ],
    "merge-plugin": {
      "include": [
        "core/composer.json"
      ],
      "recurse": false,
      "replace": false,
      "merge-extra": false
    },
    "patches": {
      "drupal/smtp": {
        "Remove install config" : "https://www.drupal.org/files/issues/remove_install-2651434-2.patch"
      }
    }
  },
  "autoload": {
    "psr-4": {
      "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
    }
  },
  "scripts": {
    "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
    "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
    "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
    "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
  }
}

Solution

First of all, the composer.json you gave as example is not valid:

• Comma at the last line of a section is not allowed.
• drupal/bootstrap, drupal/address and drupal/advagg can not be found at Packagist.

To achieve the following

Use the most recent stable version of modules/libraries whenever possible, except in a few cases where I explicitly declare otherwise.

you will just need to set the "minimum-stability": "stable" which means only stable versions are fetched. And use the @dev flag for the explicitly few cases you mentioned. prefer-stable is not needed in this case.

Let's take the following composer.json as an example. This will install only stable versions of the listed packages:

{
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "cweagans/composer-patches": "~1.0",
        "behat/mink-selenium2-driver": "^1.3",
        "drupal/drupal-extension": "^3.1",
    },
    "minimum-stability": "stable"
}

If you now change the first line of the require section from

"composer/installers": "^1.0.21",

to

"composer/installers": "^1.0.21@dev",

It will install only stable versions of all listed packages except composer/installers. Because the @dev flag overrides the "minimum-stability": "stable" this will download the dev version of only this package.

Another minimal example with Drupal Packagist:

{
    "require": {
       "composer/installers": "^1.0.21",
       "wikimedia/composer-merge-plugin": "~1.3",
       "cweagans/composer-patches": "~1.0",
       "behat/mink-selenium2-driver": "^1.3",
       "drupal/drupal-extension": "^3.1",
       "drupal/bootstrap": "8.3.*@dev"
     },
     "replace": {
       "drupal/core": "~8.0"
     },
     "minimum-stability": "stable",
     "repositories": [
        {
            "type": "composer",
            "url": "http://packagist.drupal-composer.org"
        }
    ]
}

I used an empty folder only with the composer.json from above and I ran composer install. (for your project you could remove the vendor/ folder completely and remove the composer.lock before running composer install. Make a backup before!).

It installed the latest dev version of drupal/bootstrap as you can see from the console output below:

- Installing drupal/bootstrap (dev-8.x-3.x 6a37bf5)
  Cloning 6a37bf5977c54dde4fe58f40118a8c71ce7e145a

If you compare the hash 6a37bf5977c54dde4fe58f40118a8c71ce7e145a from the installed version with the source code at http://cgit.drupalcode.org/bootstrap/log/ you can see that it installed the latest version (At this time Issue #2672514 by neardark: update documentation).

Answered By - Pᴇʜ