Composer.lock in library

Question

I have an application using Composer here at work, and we commit the composer.lock file so our dev and prod are the same. But when creating a library that is installed by composer, should I commit the composer.lock file for the library as well? Or will that cause problems for our internal repo or for composer itself?

Answer 1

It won't cause any issue because the composer.lock is only used when you actually run composer install within the library's root directory. When it is installed as a dependency the dependencies' lock files are never taken into account.

That said, for libraries it indeed does not really make sense to commit a lock file, so feel free to .gitignore it. We just say to always commit it because that is what 99% of the people should do. If some library authors know better and ignore it in their libs that's fine, but it does not really matter either way.