Composer dependencies in VCS The best practice for composer dependencies is to keep them ignored in VCS. On some rare occasions, you may need to keep them there. So, how to do it correctly?