composer.lock should be in version controll

as it stores the current version/state of all dependencies - https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file