Hacker News Reader

You always choose a reliable dependency not something random. I never had similar experience or saw a project doing that.

You should only version composer.lock and composer.json files. Ignore vendor directory and leave that job to your build step in CI/CD...

View on HN

That's why we have our own composer repository powered by satis. When set up correctly, it can be used as a "proxy" for packagist, ensuring you always have an installable version of your dependencies, even if they are not available via packagist anymore.

Most insightful comment on this thread. I'm looking into satis now, thank you!

https://github.com/composer/satis

Things disappear, or get deleted, or old versions get replaced for various reasons. There's no "reliable dependency". Even if you think something's reliable, sone deeper dependency may disappear. See npm and left-pad for example.

Committing vendor directory may or may not be a good idea. But having your own copy of all dependencies (current and past) is necessary.

> But having your own copy of all dependencies (current and past) is necessary.

Definitely! Git mirrors are cheap, and there are various solutions for composer proxies out there. If you consider CI/CD you will want freedom from external calls anyway.

Reply on news.ycombinator.com