Post #2965870

#Composer currently supports locking a branch to a specific commit: `dev-main#a1b2c3d4` However, it does not support combining a semantic version constraint with a specific immutable commit SHA: `^1.2.3#a1b2c3d4` Would Composer consider adding support for dependency constraints that combine a semantic version with an immutable commit SHA? - Protect users from malicious/compromised tag re-targeting - Ensure a tagged release resolves to an expected immutable commit or fail #PHP #ComposerPHP