Resolving the conflicts in composer.json can be done in the usual way: use a diff tool and pull into the merged file the correct changes from both sides. Save the merged file, add it to the index and you’re good to go.

Regarding a VCS conflict, composer.lock behaves more like a binary file. It is possible to do a manual merge but in the end the generated file will be invalid because it also contains a checksum that won’t match any more after this operation. The checksum can be fixed afterwards by running composer update --lock but, as a side-effect, this command also computes the current set of dependencies and renders all the manual hardwork useless.

The easiest (and the correct) way to resolve composer.lock merge conflicts is to pick one of the versions (yours should be the one because it matches the current content of the vendor directory) then run composer update --root-reqs to update composer.lock with the packages that were added or modified in composer.json on the other branch.

The commands are:

1
2
3

git reset HEAD -- composer.lock
git checkout -- composer.lock
composer update --root-reqs

Now composer.lock contains the changes introduced by the merged branch and it can be added to the index to conclude the merge.