What is composer.lock
The purpose of the lock file is to record the exact versions of packages that are installed for your application on your environment. The content of the file is managed by composer and is not manually edited.
When the composer.lock file exists the composer install command will install the exact versions on the lock file and basically ignore the composer.json file.
How to make drupal install notice the composer.json again
Well simply you can