title: Composer & composer.lock in GIT and merge conflicts
body: <p>Here's our situation :</p>
  
  <p>We have 3 different Laravel projects and all 3 projects rely on our Core project.
  This Core project is a separate Laravel package hosted on our private repo and is used as a dependency for other projects.</p>
  
  <p>Before, whenever something would change in the Core project we woud just run a composer update ourvendor/ourcorepackage on our servers for each project to pull in the core changes. However as of lately composer seems to suffer from serious memory issues when we try to run the update on our Digital Ocean staging environment with 512 MB Ram. See : <a href="https://github.com/composer/composer/issues/1898" rel="noreferrer">https://github.com/composer/composer/issues/1898</a></p>
  
  <p>The solution I always come across is people saying that you should always run composer install on your production servers. I can relate to that in terms of security because it can be dangerous if you update to a new version of some 3rd party package that can possibly break your code. But in our case we only update our own core package so we know what we're doing but this memory issue forces us to use the composer install method because it is less memory demanding.</p>
  
  <p>So basically this is our current workflow :</p>
  
  <ol>
  <li><p>When something changes in our core package we need to run a composer
  update ourvendor/ourpackage on each project LOCALLY This generates a
  composer.lock file</p></li>
  <li><p>We commit the composer.lock file in our repo</p></li>
  <li><p>On the servers for each project we run a git pull and run a composer
  install. This will only update our core package and runs much faster
  and has no memory issues vs composer update</p></li>
  </ol>
  
  <p>However this solution raises 2 issues :</p>
  
  <ol>
  <li>Since we're working with multiple devs on the same project we sometimes end up having merge conflicts for the composer.lock file when pulling in the changes locally.</li>
  <li>Running a git pull on the server gives an error : Your local changes to the following files would be overwritten by merge: composer.lock
  Please, commit your changes or stash them before you can merge.</li>
  </ol>
  
  <p>So what am I supposed to do here? Before the pull on the server remove the composer.lock file?
  How should we handle the merge conflicts for the composer.lock file?</p>
  
  <p>It's a shame that composer update suffers from memory issues because that method seems much more logical. Just update the package you want and no hassle with the composer.lock file..</p>
  
  <p>Please advice how a correct workflow with GIT and composer should be in our case and how to solve the conflicts above ?</p>
  
  <p>Many thanks for your input</p>