`composer.lock` should be a part of vcs and not ignored.