Good point.

So all contributors to this project have to put `composer.lock` in `.git/info/exclude` to not bring it in.