composer.json minimum-stability and prefer-stable

minimum-stability in composer.json decides the least stable version Composer is allowed to install for any dependency. The default is stable, so tagged releases like 2.1.0 are accepted and versions such as 2.2.0-beta1 or dev-main are not. When a package only has unstable versions, Composer reports that it could not find a version matching your minimum-stability. Lower the stability for that one package with a flag such as @dev, rather than for the whole project.

The levels

From least to most stable: dev, alpha, beta, RC, stable. A setting allows its level and everything more stable.

Allow one unstable package (preferred)

{
  "require": {
    "vendor/stable-lib": "^2.0",
    "vendor/new-lib": "^1.0@beta",
    "vendor/fork": "dev-main"
  }
}

The @beta (or @dev, @RC, @alpha) stability flag applies to that constraint only. A dev-BRANCH constraint implicitly allows dev stability for that package. Dependencies of the unstable package still have to satisfy the global minimum-stability.

Lowering it globally with prefer-stable

{
  "minimum-stability": "dev",
  "prefer-stable": true
}

With prefer-stable: true, Composer still picks a stable version whenever one satisfies the constraints and falls back to unstable versions only where nothing else fits. Without it, "minimum-stability": "dev" can pull in development branches of any package.