I started working with Drupal 8 and tried to find out the best way for developing and administrating projects. As Drupal 8 with all its dependencies is very big (more than 60 MB) I like the suggestion not to commit all the Drupal core, modules and dependencies into a git repository but to let Composer deal these things. The idea is to set everything (Drupal core version, installed modules with their versions) in the composer.json, commit this file to a GIT repository and when a remote colleague wants to work on the project he/she just checks out the composer.json from the repo locally, starts composer install and all the needed PHP files (Drupal core, modules and dependencies) get downloaded (as far as I understand).
For me this seems to be an interesting way to start new projects but I feel that this could be some kind of bottleneck for the everyday project management. For example when I define the modules and the core in composer.json usually it seems to be done in a more general way in terms of the version. Usually not the specific version seems to be defined in composer.json:
When I start
composer install locally earlier as my colleague he/she might get a newer version of Drupal which may lead to different behaviors of our working copies (although it should not with regards to versioning rules - I know). But if we define a specific version:
so we can be sure that every remote colleague will have the exact same version we can not use
composer update to update to newer versions automatically - we would need to look for the latest version and change the version in composer.json manually.
The same appears with contributed modules or themes.
To be honest, I never worked with Composer before; maybe someone with more composer experience could explain to me how to deal with these issues.