composer.lock CANNOT be on .gitignore !