Composer can install a package either as a downloaded archive or as a git clone. The default depends on package metadata and on whether the version is a stable tag, which means the same composer install produces different working trees on different machines.
# deploys: archives only, no .git directories, much faster
composer install --prefer-dist --no-dev --optimize-autoloader
# working on a dependency: clone it so you can commit
composer update vendor/package --prefer-source--prefer-dist is what a deploy wants: smaller, faster, and no .git directories shipped to production. --prefer-source is what you want when the dependency is one you are about to patch, because it gives you a real checkout to branch from. Pinning it explicitly in the deploy script removes a class of “works locally” surprise.