It is a general practice to not commit composer.lock files for libraries. It is unfortunate to have broken PR check when some analytics dependency like phpstan is upgraded and has new checks.