I would rather say ``composer.lock`` than ``composer.json``. If you change your composer.json without updating the lock file, the locked dependencies will be installed here, not the new requirements (as you haven't run ``composer update`` to update the locked versions)