Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

21
  • 22
    Agreed. I feel it makes more sense to specify dependency versions in composer.json where the required versions are more explicitly stated. But if you don't set specific versions, better to commit the composer.lock. It's confusing if the versions specified in composer.json are different than those installed as per a composer.lock. Also it depends on the app (in-house or general release) and its dev cycle. Of course, the composer docs do say, in bold, "Commit your application's composer.lock (along with composer.json) into version control". Choose wisely =) Commented Mar 19, 2014 at 23:23
  • 12
    After much soul searching I've decided, on this point, the composer docs are wrong :) I have a rule that I don't add generated material to the VCS; I allow the build process to handle that. Commented Mar 20, 2014 at 16:32
  • 12
    Isn't the code created using your biomechanical key-pressers "generated material"? I'm not sure that is a solid criteria to base a policy on. =) Commented Mar 21, 2014 at 21:25
  • 5
    @borfast I know I'm a little late to conversation so you may have seen this by this point but, you can specify a hash in the composer.json. In the require section, you can put: "repo": "dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e". This will 1) go to the branch, 2) checkout that hash, 3) if the hash is not found on the branch, however, it will checkout the head of the specified branch (master in this case).
    – CEPA
    Commented Jan 8, 2015 at 15:27
  • 5
    @CEPA - That's odd. I would have expected it to fail if the hash couldn't be found. Seems dangerous. Commented Mar 15, 2015 at 1:15