Should composer.lock be committed to version control?

Question

I\'m a little confused with composer.lock used in an application with a repository.

I saw many people saying that we should not .gitignore

Answer 1

If you update your libs, you want to commit the lockfile too. It basically states that your project is locked to those specific versions of the libs you are using.

If you commit your changes, and someone pulls your code and updates the dependencies, the lockfile should be unmodified. If it is modified, it means that you have a new version of something.

Having it in the repository assures you that each developer is using the same versions.