Lorna Jane Mitchell explains on her blog which options you have when you see "lock file out of date" warning.
composer.lockalso includes a hash of the current
composer.jsonwhen it updates, so you can always tell if you've added a requirement to the
composer.jsonfile and forgotten to install it. In that case, you'll see an error message like:Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. Run update to update them.You now have three options: upgrade everything, figure it out, or do nothing.