I work on a Symfony 2 codebase.
We use a number of third-party packages (most are in the Symfony Standard Edition).
We use composer for dependencies.
We current have all of our third-party code committed in our repository (after changing .gitignore files) to ensure stability.
According to Proper Programming Practices™, we are not supposed to have any third-party packages in our repo. We are supposed to pull them down and include them at build time.
How are we to do proper QA and debugging when at any given time our dependencies could push an update that breaks functionality?