requiring a specific commit of a package - composer seems to be ignoring composer.json requirements

Question

I have the following composer.json / require:

    "require": {
        "php": ">=7.0",
        "ext-mbstring": "*&