composer.lock could/should be commited to the repository

[dschmidt]

Hi,

is there a specific reason that you explicitly gitignore the composer.lock file?
IMHO it would be good to commit it and make (especially older) releases/docker images more reproducible.

See https://getcomposer.org/doc/01-basic-usage.md#commit-your-composer-lock-file-to-version-control

I'm maintaining a docker image build and I've run into issues again and again because version ranges matched new packages and builds started to fail from one day to another.
Moreover, commiting it would make builds and QA for you more reliable as well.

Thoughts?

[dschmidt]

I'd like to add with all the supply chain attacks we've seen recently in all sort of ecosystems it would especially be good to pin dependencies to very specific checksummed versions