# Composer.lock & Packagist Issues

**URL:** https://discourse.roots.io/t/composer-lock-packagist-issues/5947
**Category:** bedrock
**Tags:** composer
**Created:** 2016-02-15T22:27:10Z
**Posts:** 7
**Showing post:** 6 of 7

## Post 6 by @masoninthesis — 2016-02-16T04:32:31Z

I thought it was solved, but I’m having new issues when trying to deploy–

I still got an error when deploying, which led me to realizing that my composer.lock file wasn’t synced with my composer.json.

I’ve tried a handful of different solutions.

1. I tried deleting the .lock file and composer updating
2. I tried deleteing the .lock file and composer installing
3. I tried doing 1 and 2 while first clearing Composer cache (using a couple different methods: `composer clear-cache` and `rm -rf ~/.composer/cache`.
4. I tried reverting to the original .json, updating/installing (so that it would remove all my plugins), then adding them back in and composer installing/updating.

The strange thing is that no matter what I do, it seems to pull my old URLs, not the ones in the current composer.json. I tried git committing every step of the way incase I wasn’t using the updated json in the git repo. Still no luck.

Even though I clear the cache, it’s seems to magically be pulling old json URLs into the .lock file.

I’ve read[the documentation on .lock files](https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file). One thing that sticks out to me is that my `composer.phar` doesn’t seem to exist in Bedrock or in `usr/local/bin`. Or at least the command `php composer.phar update` returns this: `Could not open input file: composer.phar`

Another thing to note is that all of these issues stem from the fact that GravityForms constantly updates their download links. I started this thread awhile back on [how to use composer with Gravityforms](https://discourse.roots.io/t/best-practice-adding-gravity-forms-and-other-plugins/5320/6), and I should try hosting my plugins in a private repo instead of linking to GFs’ amazon servers, but I don’t think that will solve this particular bug at the moment. The bug is that the .lock file isn’t using the new URLs I put in the .json.

Edit: Let me know if your guys (@kalenjohnson) want me to start a new topic on this, because it’s overlapping but not the original issue. Imo, this is a very important topic because it’s prevented me from deploying all day, which is no bueno. (obviously it’s a GFs/Composer issue, not Roots or Bedrock).

---

_[View the full topic](https://discourse.roots.io/t/composer-lock-packagist-issues/5947)._