Use Composer locally and commit the lock file to the repository. No stable version of Composer exists yet. Developers and CI servers should use the same Composer version. Optimize the autoloader and understand how install, update, and require work. Only use update to upgrade dependencies and check that the lock file is not accidentally committed during code reviews.

1. Notes

2.  Use composer locally, commit in repository
 No stable version yet
 Developers and CI server will use the same version of Composer
 Optimize autoloader
 install vs update vs require
 Use composer update only during upgrade of deps
 You can upgrade specific deps
 composer update some/dep foo/bar
 Code review: check if .lock file wasn’t accidentally committed!
 New dependency
 composer require “some/dep=1.1.*”

3.  Build: add composer update --dry-run
 "minimum-stability": "stable“
 “require”: {“some/dep”: “2.2@dev”}
 “require”: {“some/dep”: “2.2@alpha”}
 “require”: {“some/dep”: “dev-master”}
 Still having issues?
 Check stability of dependencies!
 Symfony 3.3.x & DoctrineMigrationsBundle
 "doctrine/migrations": "dev-master",
 "doctrine/doctrine-fixtures-bundle": "dev-master",
 Install
 --dev Enables installation of require-dev packages.
 --optimize-autoloader