We use a few dependencies in our composer.json that target a specific commit (e.g. dev-master#4b7c20db3c72a859df049701db43659187bc4573). Every time VSCode starts, these dependencies are reparsed, even if no file has changed since the last time VSCode has started. Within the log output, this is seen:

[Warn  - 9:35:35 AM] Could not compute cache key for phing/phing

It looks like the cache key is decided in src/Indexer.php. When a version isn't used, could you cache off of the commit ID (if available)?