php - composer.lock: how does it work?

Question

I'm trying to understand this part: http://getcomposer.org/doc/02-libraries.md#lock-file

this lock file will not have any effect on other projects that depend on it. It only has an effect on the main project"

Does that mean that if project P depends on library A, and library A depends on library B v1.3, project P won't care about the version of library B, and will possibly install B 1.4 instead? What's the point then?

Or does it mean the opposite, as one would expect from a dependency manager?

Answer 1

composer.lock records the exact versions that are installed. So that you are in the same versions with your co-workers.

composer install

• Check for composer.lock file
• If not, auto generate composer.lock file (Using composer update)
• Install the specified versions recorded in the composer.lock file

composer update

• Go through the composer.json file
• Check availability of newer (latest) versions, based on the version criteria mentioned (e.g. 1.12.*)
• Install the latest possible (according to above) versions
• Update composer.lock file with installed versions

---

So in a simple check list.

If you want to keep all co-workers in the same versions as you...

• Commit your composer.lock to GIT (or vcs you have)
• Ask others to get the that version of composer.lock file
• Always use composer install to get the correct dependencies

If you want to Upgrade the system dependencies to new versions

• Check the composer.json file for version specs.
• Do a composer update
• This will change the composer.lock file with newest versions
• Commit it to the GIT (or vcs)
• Ask others to get it and composer install

Following will be a very good reading
https://blog.engineyard.com/2014/composer-its-all-about-the-lock-file

Enjoy the power of composer.lock file!