4 ms·

You always choose a reliable dependency not something random. I never had similar experience or saw a project doing that. You should only version composer.lock

• viraptor 8y ago
  Things disappear, or get deleted, or old versions get replaced for various reasons. There's no "reliable dependency". Even if you think something's reliable, sone deeper dependency may disappear. See npm and left-pad for example. Committing vendor directory may or may not be a good idea. But having your own copy of all dependencies (current and past) is necessary.
  • marenkay 8y ago
    > But having your own copy of all dependencies (current and past) is necessary. Definitely! Git mirrors are cheap, and there are various solutions for composer proxies out there. If you consider CI/CD you will want freedom from external calls anyway.
• mnemnc 8y ago
  That's why we have our own composer repository powered by satis. When set up correctly, it can be used as a "proxy" for packagist, ensuring you always have an installable version of your dependencies, even if they are not available via packagist anymore.
  • dotancohen 8y ago
    Most insightful comment on this thread. I'm looking into satis now, thank you! https://github.com/composer/satis https://github.com/composer/satis