We're using satis to create a mirror with all the required composer packages and we're deploying from there. https://github.com/composer/satis https://github.c

We're using satis to create a mirror with all the required composer packages and we're deploying from there. https://github.com/composer/satis https://github.com/composer/satis The main reason that we switch to that was exactly to avoid deployment issues. Security is also a bonus (in case somebody modifies existing packages). Probably there are tools like this for all type of packages.