Yes obviously.
That’s because a locally installed composer will give first preference to composer.lock file over composer.json.
If lock file is not available in vcs the composer will point to composer.json file to install latest dependencies or versions.
The file composer.lock maintains dependency in more depth i.e it points to the actual commit of the version of the package we include in our software, hence this is one of the most important files which handles the dependency more finely.
Head on to this article to learn more in details.
