If you are going with the composer.lock approach then you should swap these out for the least specific expression that is still valid. For example if all 1.x is compatible then use that, otherwise if 1.1 had some backwards incompatible change leave as 1.0.x, etc. The composer.lock will be used on install so the versions you have tested with and last pushed will be used initially. Same goes for all other version numbers.