Keep the lock there.

composer.lock allows you to install.