Composer在每次运行更新时交替删除/重新安装相同的软件包

Question

基本问题是：

$ composer update
Package operations: 1 install, 3 updates, 1 removal
- Removing psr/http-client (1.0.0)
- Downgrading php-http/httplug (v2.0.0 => v1.1.0): Loading from cache
- Downgrading php-http/client-common (2.0.0 => 1.9.1): Loading from cache
- Downgrading php-http/curl-client (2.0.0 => v1.7.1): Loading from cache
- Installing php-http/guzzle6-adapter (v1.1.1): Loading from cache
Writing lock file...etc

$ composer update
Package operations: 1 install, 3 updates, 1 removal
- Removing php-http/guzzle6-adapter (v1.1.1)
- Installing psr/http-client (1.0.0): Loading from cache
- Updating php-http/httplug (v1.1.0 => v2.0.0): Loading from cache
- Updating php-http/curl-client (v1.7.1 => 2.0.0): Loading from cache
- Updating php-http/client-common (1.9.1 => 2.0.0): Loading from cache
Writing lock file...etc

因此，每次我运行update时，它都会在安装/删除相同的包之间交替，每次都会让它处于不同的结束状态。

Composer.json摘录：

"require": {
    "php": "^7.1.3",
    "fideloper/proxy": "^4.1",
    "guzzlehttp/guzzle": "^6.3",
    "laracasts/flash": "^3.0",
    "laravel/framework": "5.8.*",
    "laravel/telescope": "^2.0",
    "laravel/tinker": "^1.0",
    "laravelcollective/html": "^5.8",
    "sentry/sentry": "^2.0",
    "sentry/sentry-laravel": "^1.0",
    "somsip/blc_knd": "dev-master",
    "symfony/css-selector": "^4.2",
    "symfony/dom-crawler": "^4.2"
},

唯一不能确定的就是登录到Sentry。追踪这个问题将我带到为异步POST到Sentry DSN创建的Promise，这就是它失败的地方，它指出了问题根源于正在安装/删除的HTTP库的一般方向。我在composer.json中看不到最近有任何变化，也没有关于这些方面的问题的报告。

这是不是有一种显而易见的方法来解决Composer正在做的事情，或者我是不是要忍受几天，看看某个不可靠的包是否会被修复？

稍后：

如果我运行'composer update --no-dev‘，它不会显示此行为，这可能表明冲突在"require-dev“中。因为somsip/blc_knd是我的，所以我将首先修复其中的一些依赖项。

"require-dev": {
    "barryvdh/laravel-debugbar": "^3.2",
    "beyondcode/laravel-dump-server": "^1.2",
    "beyondcode/laravel-query-detector": "^1.0",
    "filp/whoops": "^2.3",
    "fzaninotto/faker": "^1.8",
    "laravel/dusk": "^5.0",
    "mayflower/php-codebrowser": "^2.0",
    "mockery/mockery": "^1.2",
    "nunomaduro/collision": "^2.1",
    "nunomaduro/larastan": "^0.3.17",
    "pdepend/pdepend": "^2.5",
    "phploc/phploc": "^4.0",
    "phpmd/phpmd": "^2.6",
    "phpunit/phpunit": "^7.5",
    "roave/security-advisories": "dev-master",
    "sebastian/phpcpd": "^4.1",
    "squizlabs/php_codesniffer": "^3.4"
},

最终编辑：

这被压缩到一个独立的composer.json中，允许问题重现。在composer/composer包下创建了一个问题：

https://github.com/composer/composer/issues/8306

可能有两个独立的问题:包中存在依赖冲突，composer没有很好地处理冲突。

与Sentry相关的问题是众所周知的，尽管它让我找到了作曲家的bug，但它似乎与它没有任何关系：

https://github.com/getsentry/sentry-php/issues/871

Answer 1

为了确认这一点已经在composer 2.0中得到了证明，在bug工单上给出了结束评论：

https://github.com/composer/composer/issues/8306#issuecomment-597696922