Fix #refs handling, fixes #5291

src/Composer/Installer.php

@@ -970,6 +970,8 @@ class Installer
                         )
                     )) {
                         $operations[] = new UpdateOperation($package, $newPackage);
+
+                        continue;
                     }
                 }
 
@@ -978,7 +980,7 @@ class Installer
                     $references = $this->package->getReferences();
 
                     if (isset($references[$package->getName()]) && $references[$package->getName()] !== $package->getSourceReference()) {
-                        // changing the source ref to update to will be handled in the operations loop below
+                        // changing the source ref to update to will be handled in the operations loop
                         $operations[] = new UpdateOperation($package, clone $package);
                     }
                 }
@@ -1062,6 +1064,8 @@ class Installer
             return;
         }
 
+        $rootRefs = $this->package->getReferences();
+
         foreach ($localRepo->getCanonicalPackages() as $package) {
             // find similar packages (name/version) in all repositories
             $matches = $pool->whatProvides($package->getName(), new Constraint('=', $package->getVersion()));
@@ -1088,8 +1092,13 @@ class Installer
                 // update the dist and source URLs
                 $sourceUrl = $package->getSourceUrl();
                 $newSourceUrl = $newPackage->getSourceUrl();
+                $newReference = $newPackage->getSourceReference();
 
-                $this->updatePackageUrl($package, $newSourceUrl, $newPackage->getSourceType(), $newPackage->getSourceReference(), $newPackage->getDistUrl());
+                if ($package->isDev() && isset($rootRefs[$package->getName()]) && $package->getSourceReference() === $rootRefs[$package->getName()]) {
+                    $newReference = $rootRefs[$package->getName()];
+                }
+
+                $this->updatePackageUrl($package, $newSourceUrl, $newPackage->getSourceType(), $newReference, $newPackage->getDistUrl());
 
                 if ($package instanceof CompletePackage && $newPackage instanceof CompletePackage) {
                     $package->setAbandoned($newPackage->getReplacementPackage() ?: $newPackage->isAbandoned());

tests/Composer/Test/Fixtures/installer/update-changes-url.test

@@ -7,6 +7,7 @@ c/c is a tag and not whitelisted and gets the new URL but keeps its old ref
 d/d is dev but with a #ref so it should get URL updated but not the reference
 e/e is dev and newly installed with a #ref so it should get the correct URL but with the #111 ref
 e/e is dev but not whitelisted and gets the new URL but keeps its old ref
+g/g is dev and installed in a different ref than the #ref, so it gets updated and gets the new URL but not the new ref
 --COMPOSER--
 {
     "repositories": [
@@ -42,6 +43,11 @@ e/e is dev but not whitelisted and gets the new URL but keeps its old ref
                     "name": "f/f", "version": "dev-master",
                     "source": { "reference": "2222222222222222222222222222222222222222", "url": "https://github.com/f/newf", "type": "git" },
                     "dist": { "reference": "2222222222222222222222222222222222222222", "url": "https://api.github.com/repos/f/newf/zipball/2222222222222222222222222222222222222222", "type": "zip" }
+                },
+                {
+                    "name": "g/g", "version": "dev-master",
+                    "source": { "reference": "2222222222222222222222222222222222222222", "url": "https://github.com/g/newg", "type": "git" },
+                    "dist": { "reference": "2222222222222222222222222222222222222222", "url": "https://api.github.com/repos/g/newg/zipball/2222222222222222222222222222222222222222", "type": "zip" }
                 }
             ]
         }
@@ -52,7 +58,8 @@ e/e is dev but not whitelisted and gets the new URL but keeps its old ref
         "c/c": "1.0.0",
         "d/d": "dev-master#1111111111111111111111111111111111111111",
         "e/e": "dev-master#1111111111111111111111111111111111111111",
-        "f/f": "dev-master"
+        "f/f": "dev-master",
+        "g/g": "dev-master#1111111111111111111111111111111111111111"
     }
 }
 --INSTALLED--
@@ -81,6 +88,11 @@ e/e is dev but not whitelisted and gets the new URL but keeps its old ref
         "name": "f/f", "version": "dev-master",
         "source": { "reference": "1111111111111111111111111111111111111111", "url": "https://github.com/f/f", "type": "git" },
         "dist": { "reference": "1111111111111111111111111111111111111111", "url": "https://api.github.com/repos/f/f/zipball/1111111111111111111111111111111111111111", "type": "zip" }
+    },
+    {
+        "name": "g/g", "version": "dev-master",
+        "source": { "reference": "0000000000000000000000000000000000000000", "url": "https://github.com/g/g", "type": "git" },
+        "dist": { "reference": "0000000000000000000000000000000000000000", "url": "https://api.github.com/repos/g/g/zipball/0000000000000000000000000000000000000000", "type": "zip" }
     }
 ]
 --EXPECT-LOCK--
@@ -121,6 +133,12 @@ e/e is dev but not whitelisted and gets the new URL but keeps its old ref
             "source": { "reference": "1111111111111111111111111111111111111111", "url": "https://github.com/f/newf", "type": "git" },
             "dist": { "reference": "1111111111111111111111111111111111111111", "url": "https://api.github.com/repos/f/newf/zipball/1111111111111111111111111111111111111111", "type": "zip", "shasum": null },
             "type": "library"
+        },
+        {
+            "name": "g/g", "version": "dev-master",
+            "source": { "reference": "1111111111111111111111111111111111111111", "url": "https://github.com/g/newg", "type": "git" },
+            "dist": { "reference": "1111111111111111111111111111111111111111", "url": "https://api.github.com/repos/g/newg/zipball/1111111111111111111111111111111111111111", "type": "zip", "shasum": null },
+            "type": "library"
         }
     ],
     "packages-dev": [],
@@ -130,7 +148,8 @@ e/e is dev but not whitelisted and gets the new URL but keeps its old ref
         "a/a": 20,
         "d/d": 20,
         "e/e": 20,
-        "f/f": 20
+        "f/f": 20,
+        "g/g": 20
     },
     "prefer-stable": false,
     "prefer-lowest": false,
@@ -138,7 +157,8 @@ e/e is dev but not whitelisted and gets the new URL but keeps its old ref
     "platform-dev": []
 }
 --RUN--
-update a/a b/b d/d
+update a/a b/b d/d g/g
 --EXPECT--
 Installing e/e (dev-master 1111111)
 Updating a/a (dev-master 1111111) to a/a (dev-master 2222222)
+Updating g/g (dev-master 0000000) to g/g (dev-master 1111111)