Indeed, that's a problem with Symfony 2.3 and that's why we decided to remove the composer.lock file from the Symfony Standard Edition. In the lock file, you have the ICU version for the computer on which you ran composer install, but this is not necessarily what the end user will have. So, if you depend on ICU, you cannot share the composer.lock anymore. We should definitely find a solution. That makes me think that we should create an issue to keep it in mind.