This dependency is described in <code>composer.json</code> file.

File <code>composer.lock</code> is generated automaticaly after every <code>composer install</code> or <code>composer update</code>. I've even added this file to .gitignore