[philjohn]

or use composer, and commit composer.lock to ensure when composer install is run you'll get the dependency versions that are meant to ship with the release.