@Danack
I see, surely can happen if the whole thing is set up not keeping that in mind, yeah.
If I understand correctly, the composer uses this .lock file to keep that from happening? And I guess if at some point you want newer versions, some person will test the newer versions and then generate an updated .lock file for everyone else (checked in)