Composer: The lock file is not up to date with the latest changes in composer.json

Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. means the content-hash stored in composer.lock does not match the current composer.json. Someone changed composer.json without running composer update, so composer install would install what the old lock says. Run composer update vendor/package for the package that changed (or composer update --lock if only metadata changed) and commit the new composer.lock.

What happens next

With only a changed constraint, composer install prints the warning and installs from the lock file anyway. If composer.json requires a package that the lock file does not contain at all, Composer 2 stops instead, reporting that the required package is not present in the lock file, and suggests running composer update.

Fix

composer update vendor/package       # re-resolve only the package you changed
composer update --lock               # only refresh the hash, no version changes
composer validate                    # confirms composer.json and composer.lock agree
git add composer.json composer.lock

Prefer composer require vendor/package:^2.0 and composer remove vendor/package over editing composer.json by hand: they update the lock file in the same step.

Resolving a merge conflict in composer.lock