I want to make sure composer is using an exact version of a git repository by specifing the SHA1 of the commit. How can I do this? You can specify it after the version, as such (assuming you want the master branch): “dev-master#a93cbe224”