we should not provide one in the package but developers should commit them when starting a new project so that all share the same versions and only explicit composer update command will change that. Escpecially important when deploying to production.