Comment by shakesbeard

That's just not true. It's not JS. Composer will install exactly one version of every package. If your dependencies have incompatible dependencies themselves, then Composer will refuse to install the package. And this fact has led to PHP packages actually being maintained and kept compatible with each other. Of course, sometimes you run into dependency issues, but it's worth it because you'll always have quite clean, flat and small vendor directory. Compared to the node_modules horror it's great for maintenance.