What Is composer.lock?
composer.lock explained, including what it does and how it matters in CI/CD.
composer.lock records the exact resolved versions of all PHP dependencies.
What it is
It guarantees that composer install produces the same dependency set everywhere. Commit it for applications.
Why it matters in CI/CD
CI relies on composer.lock for reproducible installs; running composer update in CI would defeat this and is discouraged.
Key takeaways
- composer.lock pins exact PHP deps.
- Commit it for applications.
- Never run composer update in CI.
Related guides
What Is composer.json?composer.json is the manifest for a PHP project. Learn what Composer and CI do with it.
What Is a Lockfile and Why Should You Commit It?A lockfile pins the exact versions of every dependency so builds are reproducible. Learn why committing it is…
What Is a Reproducible Build?A reproducible build produces byte-for-byte identical output from the same source, every time. Learn what bre…