but the composer.json file defines whats ok, if its in there then why do we care if they have exact versions? Isn't that the point of the ranges we will use in composer.json