Should composer.lock be committed to version control? Should composer.lock be committed to version control? git git