Do you miss that the version numbers of your PHP dependencies are automatically updated in the composer.json file after a composer update
?
Just like npm or yarn are updating the version numbers in the package.json file.
Then upgrade to Composer 2.4 and say hi to composer dump
.
This version introduced a new command composer bump
which will update your composer.json file to the precise version which is pinned in the composer.lock file.
It basically will sync the composer.json with the composer.lock versions and will keep the caret version constraints, so you can still make minor or patch version upgrades.