Dayle Rees has a new tutorial on the Composer Lock File.
It’s time to run composer install again. This time, Composer will see that you have a composer.lock file in the directory. Instead, of finding compatible versions of your dependencies to fulfil the composer.json file, it will install the exact version of your dependencies as defined in your composer.lock file.
He also answers the question of should I version my composer.lock file? Plus giving a few tips on what all actions will update your lock file.