We do this with all of our PHP dependencies at work, they get committed into the project. The upside is that the deployment process is simpler, the server doesn

We do this with all of our PHP dependencies at work, they get committed into the project. The upside is that the deployment process is simpler, the server doesn't have to fetch all the libraries you depend on within each deploy and it mitigates all of the risk of left-pad style bullshit.