How to require a specific commit of a Drupal project? - composer-php

Question

I know this had been asked several times, but the other solutions don't work for me so the problem may be somewhere else.
In a dependent project I require a package like this:
"require": {
"drupal/security_review": "dev-8.x-1.x#35ebae44"
}
but composer update fails with the reason:
package/name dev-master requires drupal/security_review dev-8.x-1.x#35ebae44
-> no matching package found.
For research purposes I fetched package info:
[local]$ composer show --all drupal/security_review
name : drupal/security_review
descrip. : Site security and configuration review module.
keywords :
versions : 1.x-dev, dev-1.x
type : drupal-module
source : [git] https://git.drupal.org/project/security_review 9a3bdf82a645dabb9801f73d2d76acf8c3081d88
support
source : http://cgit.drupalcode.org/security_review
requires
drupal/core ~8.0
and then tried to use the version in place of branch omitting "dev-" part from the version as it goes as prefix:
"require": {
"drupal/security_review": "dev-1.x#35ebae44"
}
And this went differently:
[local]$ composer update
...
- Installing drupal/security_review (dev-1.x 9a3bdf8): Cloning 9a3bdf82a6
As you see it fetches commit #9a3bdf8 instead of the requested - #35ebae44.
Any ideas?

Answer 1

Needed to figure out this too, it's 1.x-dev and not dev-1.x
For example:
composer require drupal/security_review:1.x-dev#35ebae44
1/2: http://packagist.org/p/provider-latest$00ceddb9dc4b7174d6c84c3e2ac454ccd6a6cb952ab70c1ab623371566d63754.json
2/2: http://packagist.org/p/provider-2018-04$1ce22045b6ddc998c850721c3db7f2902d0d37ae5989b30f0fb40ebfa5e91833.json
Finished: success: 2, skipped: 0, failure: 0, total: 2
./composer.json has been updated
Gathering patches for root package.
> DrupalProject\composer\ScriptHandler::checkComposerVersion
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
Gathering patches for root package.
- Installing drupal/security_review (dev-1.x 35ebae44): Gathering patches for dependencies. This might take a minute.
Cloning 35ebae44 from cache
Writing lock file
Generating autoload files
> DrupalProject\composer\ScriptHandler::createRequiredFiles