Lorna Jane Mitchell explains on her blog which options you have when you see "lock file out of date" warning.

The composer.lock also includes a hash of the current composer.json when it updates, so you can always tell if you've added a requirement to the composer.json file and forgotten to install it. In that case, you'll see an error message like:
Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. Run update to update them.
You now have three options: upgrade everything, figure it out, or do nothing.

http://www.lornajane.net/posts/2016/handling-composer-lock-file-out-of-date-warning