Understanding composer.lock
Learn why composer.lock ensures reproducible builds across environments.
Understanding composer.lock is a free PHP Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Purpose of composer.lock
composer.lock records the exact version of every installed package, guaranteeing every developer and every server installs the same code.
What It Contains
For each package: name, resolved version, source URL, dist hash (checksum), and require constraints.
Reproducible Builds
When you run composer install on a machine that has a lock file, Composer installs exactly what the lock file records — ignoring version constraints.
Should You Commit it?
Always commit composer.lock for applications. This guarantees reproducible installs across all environments.
Lock File and Security
The lock file includes SHA-256 checksums. Composer verifies integrity on download — tampered packages are rejected.
When Does It Change?
The lock file changes when you run composer update, composer require, or composer remove. Normal composer install never modifies it.
Updating a Single Package
Update only one package entry without touching others:
$ composer update vendor/package-nameConflicts with composer.json
If composer.lock is out of sync with composer.json, Composer will warn and ask you to run update.
Platform Requirements
The lock file also records PHP version and extension requirements checked at lock time — preventing "works on my machine" issues.
composer.lock in CI/CD
CI pipelines should run composer install --no-dev --optimize-autoloader: uses lock exactly, skips dev packages, builds optimised classmap.
Never Edit Manually
The lock file is valid JSON, but never edit it manually — always use Composer commands.
Summary
composer.lock is the single source of truth for what is installed. Commit it, use install in production, and update only when you want newer versions.
Quick Check
What does composer install do when composer.lock exists?
Frequently asked questions
Is the “Understanding composer.lock” lesson free?
Yes — the full text of “Understanding composer.lock” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Understanding composer.lock”?
Learn why composer.lock ensures reproducible builds across environments. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start PHP Academy?
No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Understanding composer.lock” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this PHP Academy lesson?
Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Installing and Initializing Composer
- Requiring and Updating Packages
- Understanding composer.lock
- Composer Scripts and Autoloading