Box thinks a transitive dependency is a dev dependency

[theofidry]

Bug report

Question	Answer
Box version	4.6.3
PHP version	any
Platform with version	any
Github Repo	PHP-Scoper 0.18.18

Compiling a PHAR for PHP-Scoper failed when upgrading symfony/polyfill-mbstring from v1.31.0 to v1.33.0. The problematic change seems to be symfony/polyfill-mbstring@v1.31.0...v1.32.0#diff-d2ab9925cad7eac58e0ff4cc0d251a937ecf49e4b6bf57f8b95aab76648a9d34R20.

Indeed, after the update the compilation fails with:

require(/path/to/tmp/box/Box18732/vendor/symfony/polyfill-iconv/bootstrap.php): Failed to open stream: No such file or directory

Which indicates Composer could not find the polyfill-iconv scoped bootstrap file.

PHP-Scoper does require symfony/polyfill-mbstring (indirectly) but not directly symfony/polyfill-iconv which is otherwise required by Box.

Curiously:

composer why symfony/polyfill-iconv
humbug/box 4.6.3 requires symfony/polyfill-iconv (^1.28)

So not entirely sure if the issue is in Box or Composer...