what is the benefit since we do not provide a ``composer.lock`` the two are equivalent .. except that ``composer update`` will make more sense for dev as you might need to update the deps repeatedly.