In reply to Peter Suhm.

That's an issue that Composer helps solve. Packages don't need to specify an exact version, they can use quite a few different ways methods to specify anything within a major release, a minor release, or a point release. As long as the package that is being relied on follows semantic versioning (and most Composer packages do), then you should be reasonably safe in having Composer pick the best package version to install.

This is an issue that Composer helps solve, it doesn't make it a problem. When installing WordPress plugins as Composer packages as well, multiple plugins can rely on a Composer package and that package only needs to be installed once. It's a thing of beauty.