silex/silex 1.0.*@dev -> no matching package found

Question

If I create an empty folder and put composer.json there:

{
    "require": {
        "silex/silex": "1.0.*@dev"
    }
}

and than run composer install - it works fine, microframework silex and all it's requirements will be installed into vendor folder. Ok.

Now more complex example that I cant understand why it does not work. I have a project (called "FB") which depends on my own "some kind of framework" (called "light/light4"). FB project's composer.json:

{
    "repositories":[
        {
            "type":"hg",
            "url":"http://bitbucket.org/pqr/light4"
        }
    ],
    "require":{
        "light/light4":"dev-default"
    }
}

As you see it depends on my framework light/light4 hosted on bitbucket. Then light/light4 composer.json:

{
    "name":"light/light4",
    "version":"1.0.0",
    "require":{
        "php":">=5.4.0",
        "silex/silex": "1.0.*@dev",
        "twig/twig":">=1.8,<2.0-dev",
        "monolog/monolog":">=1.0.0",
        "symfony/validator":"2.1.*",
        "symfony/console":"2.1.*"
    },
    "autoload":{
        "psr-0":{
            "Light":"src/"
        },
        "files":[
            "src/functions/body.php", "src/functions/db.php", "src/functions/file.php", "src/functions/misc.php"
        ]
    }
}

light/light4 depends on silex/silex and some other things.

Since I never metioned "minimun-stability":"dev" - assume all packages by default will be installed for stable versions. Except silex/silex required by light/light4 as "silex/silex": "1.0.*@dev"

Unfortunatelly, when I run composer -v install on the root project (FB), I get following error:

Loading composer repositories with package information
Reading composer.json of light/light4 (default)
Importing branch default (dev-default)
Installing dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - light/light4 dev-default requires silex/silex 1.0.*@dev -> no matching package found.
    - light/light4 dev-default requires silex/silex 1.0.*@dev -> no matching package found.
    - Installation request for light/light4 dev-default -> satisfiable by light/light4 dev-default.

Potential causes:
 - A typo in the package name
 - The package is not available in a stable-enough version according to your minimum-stability setting
   see <https://groups.google.com/d/topic/composer-dev/_g3ASeIFlrc/discussion> for more details.

Read <http://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.

silex/silex 1.0.*@dev -> no matching package found - WHY??? It works for simple empty project, but does not work for requirements chain :(

Someone from composer-dev irc adviced to put "silex/silex": "1.0.*@dev" into general composer.json of FB project. I tried - and now it works: all packages installed in stable versions and the only silex/silex in dev version as I wanted. Now I totally confused.

The question is still there - why it works in general composer.json and does not work in nested (required) project light/light4? I what to understand to root of the issue, or it's just a bug of composer?

Answer 1

As the docs say: "require and require-dev additionally support stability flags (root-only)"

Those flags are only read from the root package (see definition of root-only) because that way it gives your project the full control over the stability of the packages. Obviously that's a problem when some of your dependencies rely on unstable stuff, but that situation should get better as more and more packages have composer-available stable releases.