title: composer require specific git commit that hasn't been merged to branch
body: <p>In my project I require a package using <code>composer</code>. This morning I learned there was a merged pull-request overnight however there was a bad function left in a class of the code which breaks it. Someone fixed the error and made a commit but it hasn't been merged to the <code>master</code> branch yet.</p>
  
  <p>So I update <code>composer.json</code> and set the <code>sha1</code> like this:</p>
  
  <pre><code>"require": {
      "vendor/package": "dev-master#d0d6b33897e1739c55a338fdd0a544bfe5a10721"
  }
  </code></pre>
  
  <p>and run <code>composer update</code> and get</p>
  
  <pre><code>d0d6b33897e1739c55a338fdd0a544bfe5a10721 is gone (history was rewritten?), recovered by checking out 33e68f9cec94d52f40192c576d7441ea12852b99
  </code></pre>
  
  <p>Is what I want to do possible on a commit that hasn't been merged? Forgive my ignorance if this is stupid - relatively new to composer. I could just manually remove the code until it's pushed but I ask mainly out of curiosity.</p>