Composer Lock File
All Doctrine projects must commit the
composer.lock file. Tools like
phpstan and phpcs
are quite fragile on patch releases and we don't want builds to start failing without us having made any changes
to our own code. Whenever a dependency needs to be upgraded, the
should be updated locally and the change submitted via pull request.