composer.lock should be versioned