Warn on exact/overly strict constraints, fixes #2746

src/Composer/Package/Loader/ValidatingArrayLoader.php

@@ -23,8 +23,9 @@ use Composer\Repository\PlatformRepository;
  */
 class ValidatingArrayLoader implements LoaderInterface
 {
-    const CHECK_ALL = 1;
+    const CHECK_ALL = 3;
     const CHECK_UNBOUND_CONSTRAINTS = 1;
+    const CHECK_STRICT_CONSTRAINTS = 2;
 
     private $loader;
     private $versionParser;
@@ -177,6 +178,13 @@ class ValidatingArrayLoader implements LoaderInterface
                             && !preg_match(PlatformRepository::PLATFORM_PACKAGE_REGEX, $package)
                         ) {
                             $this->warnings[] = $linkType.'.'.$package.' : unbound version constraints ('.$constraint.') should be avoided';
+                        } elseif (
+                            // check requires for exact constraints
+                            ($this->flags & self::CHECK_STRICT_CONSTRAINTS)
+                            && 'require' === $linkType
+                            && substr($linkConstraint, 0, 1) === '='
+                        ) {
+                            $this->warnings[] = $linkType.'.'.$package.' : exact version constraints ('.$constraint.') should be avoided if the package follows semantic versioning';
                         }
                     }
                 }

tests/Composer/Test/Package/Loader/ValidatingArrayLoaderTest.php

@@ -314,6 +314,7 @@ class ValidatingArrayLoaderTest extends \PHPUnit_Framework_TestCase
                         'bar/baz' => '>=1.0',
                         'bar/foo' => 'dev-master',
                         'bar/hacked' => '@stable',
+                        'bar/woo' => '1.0.0',
                     ),
                 ),
                 array(
@@ -321,6 +322,7 @@ class ValidatingArrayLoaderTest extends \PHPUnit_Framework_TestCase
                     'require.bar/baz : unbound version constraints (>=1.0) should be avoided',
                     'require.bar/foo : unbound version constraints (dev-master) should be avoided',
                     'require.bar/hacked : unbound version constraints (@stable) should be avoided',
+                    'require.bar/woo : exact version constraints (1.0.0) should be avoided if the package follows semantic versioning',
                 ),
                 false,
             ),