The Composer lock file is a guarantee of the dependency versions that will be installed, right down to an individual commit level.
Tom Krush
Software Engineer, Amateur Woodworker & Astronomer