Composer 1.0 platform config pins the PHP it resolves against

Composer resolves dependencies against the PHP running it, so a developer on 7.0 and a server on 5.6 get different — and both correct — lock files. The symptom is a package that installs locally and refuses on deploy.

{
    "config": {
        "platform": {
            "php": "5.6.30",
            "ext-redis": "2.2.7"
        }
    }
}

With platform set, everyone resolves against the production version regardless of what they are running, and the lock file is the same for everyone. It is a lie told to the resolver, not a compatibility check — code using PHP 7 syntax still runs locally and still fails on 5.6. Update it as the first step of a version upgrade, before anything else, so the dependency graph moves first.