Composer (PHP dependency manager) does not force you into doing automatic upgrades. You can keep a dependency fixed at a particular version indefinitely. You c

Composer (PHP dependency manager) does not force you into doing automatic upgrades. You can keep a dependency fixed at a particular version indefinitely. You can also point composer at a private vendored repository of the dependency if you don't trust the upstream server.