Is composer.lock file needed

[samikeijonen]

We might want to ignore composer.lock file.

For your library you may commit the composer.lock file if you want to. This can help your team to always test against the same dependency versions. However, this lock file will not have any effect on other projects that depend on it. It only has an effect on the main project.

Resource in composer site about composer.lock file.