composer.lock and composer install interoperability: locked versions versus fresh resolution

Direct Answer

Composer install treats the existing composer.lock as the source of truth; loosening a version constraint in composer.json does not cause Composer 2.x to discard the lock or perform a full fresh resolution. Packages whose locked versions still satisfy the new constraint are installed unchanged.

Confirmed Facts

The lock file records exact package versions, dist references and content hashes, and platform constraints. It does not capture the PHP runtime, extensions, OS libraries or environment configuration, so identical locked sets may behave differently across environments.

Likely Explanation

Composer only re‑resolves when the lock cannot satisfy the manifest: the lock is missing, its content‑hash is stale because composer.json changed in a way that affects requirements, a locked version violates a tightened requirement, or a new dependency has no entry in the lock. A simple loosening of a constraint (e.g., ^1.0 → ^2.0) leaves the previously locked version valid, so the lock remains authoritative.

When Composer 2.x Disregards the Lock

• Lock file is absent or deleted.
• Content‑hash is outdated after a manifest change that affects requirements.
• A locked version no longer meets a tightened or altered requirement.
• A new or removed dependency has no corresponding entry in the lock.

Steps to Verify in This Case

1. Back up composer.lock (e.g., cp composer.lock composer.lock.bak).
2. Loosen the constraint in composer.json.
3. Run composer install --dry-run.
4. Compare the lock before and after with git diff composer.lock or sha256sum composer.lock composer.lock.bak.
5. If the lock is unchanged, it still governs; confirm with composer show --installed that the previously locked package remains at its locked version.

Missing Diagnostic

If the dry‑run shows any change in composer.lock, share the git diff composer.lock output so we can see whether only the affected package was re‑resolved or the entire graph.