title: How composer `extra.symfony.require` restriction is enforced?
body: <p>Let's say I have a Symfony v4.4 (Flex) project with the following block in the <code>composer.json</code>:</p>
  
  <pre><code>"extra": {
      "symfony": {
          "allow-contrib": false,
          "require": "4.4.*"
      }
  }
  </code></pre>
  
  <p>As expected, it restricts the Symfony core packages to stick to the <code>v4.4</code> version.</p>
  
  <p><code>symfony/monolog-bridge</code> package respects it, so you cannot install <code>symfony/monolog-bridge ~4.3.0</code> or <code>^5.0</code>.</p>
  
  <p>Yet you can install <code>symfony/monolog-bundle ~3.5.0</code>, which is also expected, given it's just a bundle that is not part of the core Symfony framework and which has its own independent release and versioning cycle.</p>
  
  <p>What I cannot understand is what helps composer to distinguish, which of those packages a Symfony core package so that <code>extra.symfony.require</code> restriction was applied, and which is not?</p>
  
  <p>I originally thought it's the composer's <code>type</code> property that makes it possible, but I cannot find any traces of <code>symfony-bridge</code> type being any unique. If it is - a link to source code or documentation would be extremely helpful.</p>
  
  <p><strong>UPD</strong>:</p>
  
  <p>The default Symfony (with Flex) v4.4 composer.json:</p>
  
  <pre><code>{
      "name": "symfony/website-skeleton",
      "type": "project",
      "license": "MIT",
      "description": "A skeleton to start a new Symfony website",
      "require": {
          "php": "^7.1.3",
          "ext-ctype": "*",
          "ext-iconv": "*",
          "sensio/framework-extra-bundle": "^5.1",
          "symfony/asset": "*",
          "symfony/console": "*",
          "symfony/dotenv": "*",
          "symfony/expression-language": "*",
          "symfony/flex": "^1.3.1",
          "symfony/form": "*",
          "symfony/framework-bundle": "*",
          "symfony/http-client": "*",
          "symfony/intl": "*",
          "symfony/mailer": "*",
          "symfony/monolog-bundle": "^3.1",
          "symfony/orm-pack": "*",
          "symfony/process": "*",
          "symfony/security-bundle": "*",
          "symfony/serializer-pack": "*",
          "symfony/translation": "*",
          "symfony/twig-pack": "*",
          "symfony/validator": "*",
          "symfony/web-link": "*",
          "symfony/yaml": "*"
      },
      "require-dev": {
          "symfony/debug-pack": "*",
          "symfony/maker-bundle": "^1.0",
          "symfony/profiler-pack": "*",
          "symfony/test-pack": "*"
      },
      "config": {
          "preferred-install": {
              "*": "dist"
          },
          "sort-packages": true
      },
      "autoload": {
          "psr-4": {
              "App\\": "src/"
          }
      },
      "autoload-dev": {
          "psr-4": {
              "App\\Tests\\": "tests/"
          }
      },
      "replace": {
          "paragonie/random_compat": "2.*",
          "symfony/polyfill-ctype": "*",
          "symfony/polyfill-iconv": "*",
          "symfony/polyfill-php71": "*",
          "symfony/polyfill-php70": "*",
          "symfony/polyfill-php56": "*"
      },
      "scripts": {
          "auto-scripts": {
              "cache:clear": "symfony-cmd",
              "assets:install %PUBLIC_DIR%": "symfony-cmd"
          },
          "post-install-cmd": [
              "@auto-scripts"
          ],
          "post-update-cmd": [
              "@auto-scripts"
          ]
      },
      "conflict": {
          "symfony/symfony": "*"
      },
      "extra": {
          "symfony": {
              "allow-contrib": false,
              "require": "4.4.*"
          }
      }
  }
  </code></pre>
  
  <p>now if you add <code>"symfony/monolog-bridge": "^5.0"</code> dependency and <code>composer update</code> you'd get</p>
  
  <pre><code>$ composer update
  Loading composer repositories with package information
  Updating dependencies (including require-dev)
  Restricting packages listed in "symfony/symfony" to "4.4.*"
  Your requirements could not be resolved to an installable set of packages.
  
    Problem 1
      - The requested package symfony/monolog-bridge ^5.0 exists as symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these are rejected by your constraint.
    Problem 2
      - symfony/monolog-bundle v3.5.0 requires symfony/monolog-bridge ~3.4 || ~4.0 || ^5.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.5.0 requires symfony/monolog-bridge ~3.4 || ~4.0 || ^5.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.4.0 requires symfony/monolog-bridge ~3.4|~4.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.3.1 requires symfony/monolog-bridge ~2.7|~3.3|~4.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.3.0 requires symfony/monolog-bridge ~2.7|~3.3|~4.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.2.0 requires symfony/monolog-bridge ~2.7|~3.0|~4.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.1.2 requires symfony/monolog-bridge ~2.7|~3.0|~4.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.1.1 requires symfony/monolog-bridge ~2.7|~3.0|~4.0 -&gt; satisfiable by symfony/monolog-bridge[4.4.x-dev, v4.4.0, v4.4.0-BETA1, v4.4.0-BETA2, v4.4.0-RC1, v4.4.1] but these conflict with your requirements or minimum-stability.
      - symfony/monolog-bundle v3.1.0 requires symfony/monolog-bridge ~2.7|~3.0 -&gt; no matching package found.
      - Installation request for symfony/monolog-bundle ^3.1 -&gt; satisfiable by symfony/monolog-bundle[v3.1.0, v3.1.1, v3.1.2, v3.2.0, v3.3.0, v3.3.1, v3.4.0, v3.5.0].
  
  Potential causes:
   - A typo in the package name
   - The package is not available in a stable-enough version according to your minimum-stability setting
     see &lt;https://getcomposer.org/doc/04-schema.md#minimum-stability&gt; for more details.
   - It's a private package and you forgot to add a custom repository to find it
  
  Read &lt;https://getcomposer.org/doc/articles/troubleshooting.md&gt; for further common problems.
  </code></pre>
  
  <p>The question remains - how symfony knows that package should be restricted by v4.4</p>