How can PHP developers handle the integration of external packages with specific commits in a way that ensures maintainability and stability?

When integrating external packages with specific commits, PHP developers can use Composer to manage dependencies and specify the exact commit hash in the composer.json file. This ensures that the package is locked to a specific version, providing maintainability and stability to the project.

{
    "require": {
        "vendor/package": "dev-master#<commit-hash>"
    }
}