title: What's the difference between composer.lock and installed.json?
body: <p>I understand that <code>composer.lock</code> is meant to pin down the exact version of the installed dependencies. But what purpose does the <code>vendor/composer/installed.json</code> file play?</p>
  
  <p>Both contain JSON and both are generated automatically.</p>