an update can change the installed dependencies without having a different hash for the ``composer.json`` (you can get newer deps matching the same constraints)