I usually store mine in version control, as per this: https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file