Composer.lock should be in the repo.