We’ve been having a lot of discussion in the Talis development team recently about dependency management. It all kicked off from an, at the time, rather innocuous question of “_why do we need a composer.lock file checked in?_” in our PHP projects. There are differences of opinion on this - you can also browse other related pages and make your own mind up. The ‘official’ line, from one of the Composer authors can be found in Composer Best Practices, specifically here and here.