Translations:Manual:Composer.json best practices/10/en

Dependencies should be pinned to a specific version number or sha1 commit if a tag isn't available.