as we don't have the composer.lock file in the repo, the two actually do the same thing. but i think like this its more obvious we get the very latest versions of everything. note that the "require" we had previously also triggers an "update" action of the whole dependencies (unless you pass --no-update, which just adds the requirement to composer.json without installing it)