Artifact update problem with local composer packages

[dahaupt]

We use a local composer package in our project. If (sub)-dependencies are updated from this local package, the global composer.lock is not updated.

Project files:

• composer.json
• composer.lock
• packages/local_package/composer.json

The local package is required by the root package with composer require vendor/local-package:@dev. If now a dependency within the local package gets updated (e.g. vendor/library), the root composer.json should receive an update as well, e.g.:
composer update vendor/local-package. Currently, only the version gets changed within the local package.

---

We tried adding package groups in renovate.json, which unfortunately completely stopped updating the lock file.

{
  "groupName": "Library in local package",
  "packageNames": [
    "vendor/library",
    "vendor/local-package"
  ],		
},

---

Additionally, we have the situation of having the same dependency within both composer.json files (project root and local package). This results in an artifact update problem, as the locally used dependency must be included within the update command, as else the updated package is still required in a different version of the local package.

[rarkins]

We would need a public reproduction of this problem to take a closer look.

[dahaupt]

@rarkins Thanks for your fast reply. I've just created a repository where I've reproduced the situation of our project. Both described problems are shown there.

Repository: https://github.com/dahaupt/renovate-composer-local

[rarkins]

Thanks, can you also add a brief readme.md that describes the repo structure and what is going wrong? I see you've added a comment to the PR but as a non-Composer user I still don't quite understand what exactly is wrong or what Renovate should do differently.

[dahaupt]

Done. Tried my best to explain the missing functionality / logic.

[rarkins]

Thanks, this discussion can be superseded by #8176