Wrong package version installed when included with merge-plugin

Hi all

I'm experiencing a weird bug I haven't been able to figure out. When I include the filament/filament package in my app's main composer.json file, I get the latest version (v3.2.50) as expected:

    "require": {
        "php": "^8.1",
        "filament/filament": "^3.0-stable",
        "guzzlehttp/guzzle": "^7.2",
        "laravel/framework": "^11.0",
        "laravel/horizon": "^5.22",
        "laravel/sanctum": "^4.0",
        "laravel/scout": "^10.8",
        "laravel/tinker": "^2.8",
        "sentry/sentry-laravel": "*",
        "stripe/stripe-php": "^13.7",
        "wikimedia/composer-merge-plugin": "^2.1"
    },
    "extra": {
        "merge-plugin": {
            "include": [
                "modules/*/composer.json"
            ],
            "ignore-duplicates": true            
        },
        "laravel": {
            "dont-discover": []
        }
    },

But when I include it in the composer.json of one of my modules, I'm getting v3.2.40:

{
    "name": "module/filament",
    "autoload": {
        "psr-4": {
            "Modules\\Filament\\": "src/"
        }
    },
    "require": {
        "filament/filament": "^3.0-stable"
    }
}

I've tried changing it to "filament/filament": "^3.2" - same problem. It works correctly when in the main app's composer.json but not when included via the Composer Merge plugin.

I don't have any other packages that require filament/filament. I'm sure of this because when I remove it from the module/filament/composer.json it gets completely removed from the project. Doesn't that mean it's only being required in this one place, and the latest matching version should be downloaded? The only way I can get v3.2.50 to install via the module's composer.json is to use "filament/filament": "3.2.50" which obviously isn't practical.

I've also tried removing "ignore-duplicates": true and using "replace": true - same problem.

Am I missing something obvious or is this a bug?

Thanks

wikimedia / composer-merge-plugin

Wrong package version installed when included with merge-plugin #272