composer.lock
The lock file records the exact version of every installed package and its dependencies. It ensures reproducible builds across all environments.
PHP
Beginner
3 min read
The Lock File
Example
# Always commit composer.lock
git add composer.lock
# Install exact locked versions (CI, production)
composer install --no-dev --no-interaction
# Update a single package
composer update vendor/package
# After update, review the diff
git diff composer.lock | grep "\"version\"" Pro Tip
A differing lock file between environments is the most common cause of "works on my machine" bugs.