When I add a revision for a project in a "merged" composer.json, composer does not respect the commiit, like:

"require": { "drupal/config_devel": "dev-8.x-1.x#d4cdd21" }, 

Instead of using revision d4cdd21 it using the latest from HEAD. With a "normal" composer.json (not merged) it works and uses correct revision.