composer.lock doesnt need to be version controlled