This is an issue we have on symfony/symfony and I can't find a solution for now:

While on branch 2.8, I want to test one single component A.
Lets say A depends on B, but I don't know if it's B(2.8) or B(3.0).
In case it's B(2.8), I want to provide an alternative (patched) source package.
In case it's B(3.0), the upstream version is fine (as published by packagist).

What we do now in symfony is putting B source in B.tar, build a local packages.json file referencing B.tar as version 2.8.x-dev, then reference this packages.json in A's composer.json, in the repository section.

This works almost fine, but composer always prefers the local B.tar even when the upstream B(3.0) would be fine.
Is there a way around this behavior? What do I need to change?