Is "content-hash" a mandatory part of composer.lock?

Viewed 22409

Like most people writing (and reading) the question about whether to keep composer.lock in version-control, we keep ours there.

However, this causes us trouble every time the file is independently updated in different code-branches. Even when the changes are unrelated and affect the sections of the file afar from each other, the "content-hash" line is causing a conflict every time. Worse, neither "side" is correct and whoever is doing the merging must regenerate the file by hand...

Maybe, the line is not really necessary? Before asking, whether (the current version of) composer will work without it, what functionality would be missing? The hash seems to guard against the file itself changing -- but the source-control system is already doing that...

Can I simply remove the line? If it can not be done today, would it be a desirable feature for composer?

2 Answers

TL;DR version from @localheinz:

Just resolve the conflict and then regenerate the lock file with:

$ composer update --lock

This will update the content hash.

For reference, see https://getcomposer.org/doc/03-cli.md#update:

--lock: Only updates the lock file hash to suppress warning about the lock file being out of date.

Related