you should be tracking composer.lock