In reply to Otto.

Otto, with all due respect, that's completely unrelated to this issue. People will bundle libraries anyway, wether they do it via Composer or manually. Composer will just make it easier and following a proven standard, to bundle libraries. Security issues will always be there and need to be dealt with.

Actually, using Composer will make it easier for plugin developers to keep their dependencies updated. It's as simple as running 'composer update', compared to having to manually replace all the files of the bundled libraries in your plugin. I just realised that if we would install those dependencies on a server level (based on the dependencies of all active plugins, as my proof of concept assumes), we could update them without having plugins to push updates!