Replaced dependencies filtered out with --no-dev incorrectly

[remorhaz]

The problem was discovered when trying to switch from Zend Framework to Laminas in one of our projects. Let it be:

• Package A requires package B.
• Package B requires package C.
• Package B' replaces package B.
• Package C' replaces package C.
• Package B' requires package C'.

Then when composer generates autoloaders with --no-dev key for package A, it doesn't take care of replacement of package B and thus fails to include C'. This happens because Composer uses required target (which is B) to seek in a list of packages that are already replaced (and replaced package has B' as a key).

#8621

[alcohol]

It would be nice if you could include a test with the code demonstrating the scenario that it fixes.

Have a look at the many examples inside tests/Composer/Test/Fixtures/installer

[remorhaz]

I have written the test. It defines packages from a/a to e/e that autoload corresponding classes from A to E each. The relations between the packages are the following:

• main package requires a/a;
• a/a requires b/b;
• b/b requires e/e;
• c/c replaces b/b and requires d/d.

So, we have to include the following classes:

• A, because main package requires a/a;
• C, because a/a is included and requires b/b which is replaced with c/c;
• D, because c/c is included and requires d/d.

You can easily check that without my fix class D is never autoloaded.

[Seldaek]

Fixed by #8621