What is composer.lock

The purpose of the lock file is to record the exact versions of packages that are installed for your application on your environment. The content of the file is managed by composer and is not manually edited.

When the composer.lock file exists the composer install command will install the exact versions on the lock file and basically ignore the composer.json file.

How to make drupal install notice the composer.json again

Well simply you can

  • delete the lock file
  • Use the composer update command (mainly if you add a new dependency or if you wish to update all dependencies with the latest stable releases)