Update for correct composer support 

The composer.lock file stores which dependencies, and which versions, are stored in the vendor directory should not be committed to a repository. It's only used for local installs after "composer install" has been run.