composer.lock should never be committed to a VCS