composer.lock is necessary because when you deploy, you have to launch `composer.phar install` and this command read in composer.lock (and is more performant than composer update).
So, the flow is this:
in local you launch `composer update` and make sure tests are still green
If your tests are green, you can commit composer.lock.
Otherwise you can checkout or fix the bugs due to dependencies