Even not having tried it myself yet, I would recommend using composer for that.

Versioning including dependencies

By keeping the composer.lock file in the repository, you fix the versions of all modules and can always restore a specific version (a branch, tag or an older version) by using your VCS (git checkout, svn ..) and then composer.phar install.

Drawbacks

A problem which arises, is that your deployment can easily depend on multiple sources (for example GitHub) creating multiple points of failure.

So we would need some kind of cache or proxy which stores those modules so we are always able to deploy.

Satis seems to be able to serve this purpose (see https://github.com/researchgate/broker) and my question http://stackoverflow.com/q/16211671/288568

Even not having tried it myself yet, I would recommend using composer for that.

Versioning including dependencies

By keeping the composer.lock file in the repository, you fix the versions of all modules and can always restore a specific version (a branch, tag or an older version) by using your VCS (git checkout, svn ..) and then composer.phar install.

Drawbacks

A problem which arises, is that your deployment can easily depend on multiple sources (for example GitHub) creating multiple points of failure.

So we would need some kind of cache or proxy which stores those modules so we are always able to deploy.

Satis seems to be able to serve this purpose (see https://github.com/researchgate/broker) and my question https://stackoverflow.com/q/16211671/288568