stewe, if you run `composer install` without composer.lock file, composer switch the command in `composer update`.
As @seldaek say in `bold` character:
"Commit your application's composer.lock (along with composer.json) into version control."
Take a look at [this](http://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file)