How to require a specific commit of a Drupal project?

Question

I know this had been asked several times, but the other solutions don't work for me so the problem may be somewhere else.

In a dependent project I require a package like this:

"require": {
    "drupal/security_review": "dev-8.x-1.x#35ebae44"
}

but composer update fails with the reason:

package/name dev-master requires drupal/security_review dev-8.x-1.x#35ebae44 
  -> no matching package found.

For research purposes I fetched package info:

[local]$ composer show --all drupal/security_review
name     : drupal/security_review                       
descrip. : Site security and configuration review module.
keywords : 
versions : 1.x-dev, dev-1.x
type     : drupal-module
source   : [git] https://git.drupal.org/project/security_review 9a3bdf82a645dabb9801f73d2d76acf8c3081d88

support
source : http://cgit.drupalcode.org/security_review

requires
drupal/core ~8.0

and then tried to use the version in place of branch omitting "dev-" part from the version as it goes as prefix:

"require": {
    "drupal/security_review": "dev-1.x#35ebae44"
}

And this went differently:

[local]$ composer update
...
- Installing drupal/security_review (dev-1.x 9a3bdf8): Cloning 9a3bdf82a6

As you see it fetches commit #9a3bdf8 instead of the requested - #35ebae44.

Any ideas?

Answer 1

Needed to figure out this too, it's 1.x-dev and not dev-1.x

For example:

composer require drupal/security_review:1.x-dev#35ebae44
    1/2:    http://packagist.org/p/provider-latest$00ceddb9dc4b7174d6c84c3e2ac454ccd6a6cb952ab70c1ab623371566d63754.json
    2/2:    http://packagist.org/p/provider-2018-04$1ce22045b6ddc998c850721c3db7f2902d0d37ae5989b30f0fb40ebfa5e91833.json
    Finished: success: 2, skipped: 0, failure: 0, total: 2
./composer.json has been updated
Gathering patches for root package.
> DrupalProject\composer\ScriptHandler::checkComposerVersion
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
Gathering patches for root package.
  - Installing drupal/security_review (dev-1.x 35ebae44): Gathering patches for dependencies. This might take a minute.
Cloning 35ebae44 from cache
Writing lock file
Generating autoload files
> DrupalProject\composer\ScriptHandler::createRequiredFiles