I regard composer.json as a nice file because I generally understand the purpose of each chapter in it and it’s usually no longer than 100 lines. Its chapters tell me for example, in an ordinal way, the following data:
- What is the project it contains information about.
- What is the repository of the project.
- What are the required dependencies of the project and what are their current versions.
- What minimum stability for dependencies to rely on.
- What dependency type to install where.
- What messages to give and when.
- Further configurations.
On the other side, I regard composer.lock file as a very complex file which is totally non-intuitive for me and from opening it I can’t say what it’s purpose is and it has more than 6,000 lines.
Why do we need composer.lock file? Couldn’t we do without it?
I have found this saying:
composer.lock records the exact versions that are installed. So that you are in the same versions with your co-workers.
Wouldn’t it have been simpler to put exact versions in composer.json? And why assuming someone has co-workers? I for example, work alone 
1 Like
Not really. While you could specify exact versions in composer.json, it’s not practical for larger projects. You’d miss out on compatible updates (bug fixes, security patches) that follow semantic versioning. The composer.lock file allows you to control when and how to update these dependencies.
Besides, composer.json lists your project’s direct dependencies, but each dependency might have its own dependencies and composer.lock tracks these indirect dependencies as well, ensuring the entire dependency tree is consistent.
When you run composer install, Composer looks at composer.lock to install the exact versions of the dependencies listed, rather than resolving the dependencies all over again. This makes the install process faster and more consistent.
Even for solo projects, having a composer.lock ensures your development environment matches your production environment, minimizing deployment issues.
You’re not really meant to mess with this file. It is machine generated. Check it into version control, then forget about it and move on with your life 
2 Likes
Sorry, I don’t understand this probably because I don’t use git. What do you mean?
Exactly that. Add it to the files you use git to track.
Git is easy to setup and can be exceptionally helpful if you need to roll back to a previous application state. If your project consists of anything more than a few files, I would look into implementing version control.