composerlock

composerlock, more commonly written as composer.lock, is a lock file used by Composer, the dependency manager for PHP. It records the exact versions of all packages installed for a project, including transitive dependencies, at the time of dependency resolution. Its main purpose is to ensure that future installs reproduce the same dependency graph across different environments, avoiding version drift.

The file is in JSON format and typically contains sections such as packages and packages-dev. Each listed package includes fields like name, version, reference (often a VCS commit hash), source or dist information, and install path, along with metadata such as type and install-time constraints. Additional metadata may appear, including content-hash to detect changes, minimum-stability, and platform requirements. The lock file is generated and updated automatically by Composer when running install or update, and it should not be edited manually in ordinary workflows.

Generation and usage: If a project has a composer.json describing dependencies, running composer install will install the exact versions recorded in composer.lock if the file exists. If the lock file is missing, Composer resolves dependencies according to composer.json and creates a new lock file with the chosen versions. Running composer update refreshes the lock file to reflect newer versions permitted by the constraints. Committing composer.lock to version control helps ensure that all environments, including continuous integration systems, use the same dependency set.

Relation to composer.json and vendor: composer.json declares version constraints for dependencies, while composer.lock records the resolved versions. The actual packages are installed into the vendor directory, which is typically excluded from version control; the lock file itself is tracked to enable reproducible installs.

Notes: Some references use the term composerlock as shorthand, but the official file name is composer.lock.