In T199004#6275631, @daniel wrote:

As to maintaining a git repo with the fully expanded dependency tree, as @Demian describes: we are doing that for composer dependencies in the mediawiki-vendor repository. It works, but the process of keeping that in sync with mediawiki core is unfortunately cumbersome. The RFC from 2014 about this can be found at https://www.mediawiki.org/wiki/Requests_for_comment/Composer_managed_libraries_for_use_on_WMF_cluster.

@daniel A few questions, if interested:

1. What makes the process cumbersome?
2. Could that part be automated?
3. Would it be more streamlined if the package archives were added to the repo without unpacking (less files), as in the Yarn2 and Pnpm workflows?
4. Would any other package repository solution be less cumbersome, for ex. using xsync directly (just an idea, wouldn't suggest that)?

@Demian: Please set project tags - thanks.