Composer php 如何要求Drupal项目的特定提交？

我知道这个问题已经被问过好几次了，但是其他的解决方案对我不起作用，所以问题可能在其他地方

在从属项目中，我需要这样一个包：

"require": {
    "drupal/security_review": "dev-8.x-1.x#35ebae44"
}

但是

编写器更新失败，原因如下：

package/name dev-master requires drupal/security_review dev-8.x-1.x#35ebae44 
  -> no matching package found.

出于研究目的，我获取了包信息：

[local]$ composer show --all drupal/security_review
name     : drupal/security_review                       
descrip. : Site security and configuration review module.
keywords : 
versions : 1.x-dev, dev-1.x
type     : drupal-module
source   : [git] https://git.drupal.org/project/security_review 9a3bdf82a645dabb9801f73d2d76acf8c3081d88

support
source : http://cgit.drupalcode.org/security_review

requires
drupal/core ~8.0

然后尝试使用版本代替分支，在版本中省略“dev-”部分作为前缀：

"require": {
    "drupal/security_review": "dev-1.x#35ebae44"
}

这是不同的：

[local]$ composer update
...
- Installing drupal/security_review (dev-1.x 9a3bdf8): Cloning 9a3bdf82a6

如您所见，它获取commit#9a3bdf8而不是请求的-#35ebae44

有什么想法吗？
也需要解决这个问题，它是
1.x-dev
而不是
dev-1.x

例如：

composer require drupal/security_review:1.x-dev#35ebae44
    1/2:    http://packagist.org/p/provider-latest$00ceddb9dc4b7174d6c84c3e2ac454ccd6a6cb952ab70c1ab623371566d63754.json
    2/2:    http://packagist.org/p/provider-2018-04$1ce22045b6ddc998c850721c3db7f2902d0d37ae5989b30f0fb40ebfa5e91833.json
    Finished: success: 2, skipped: 0, failure: 0, total: 2
./composer.json has been updated
Gathering patches for root package.
> DrupalProject\composer\ScriptHandler::checkComposerVersion
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
Gathering patches for root package.
  - Installing drupal/security_review (dev-1.x 35ebae44): Gathering patches for dependencies. This might take a minute.
Cloning 35ebae44 from cache
Writing lock file
Generating autoload files
> DrupalProject\composer\ScriptHandler::createRequiredFiles