What means “locked at” in composer

Question

Trying to perform a composer update but getting the following error:

The requested package (locked at &l

Answer 1

The package is locked means the commit-hash of the last commit on the branch used with version-constraint dev-<branch> was saved during the last run of composer update in the lock-file to ensure deterministic (reproducible) builds upon deployment.

This commit-hash or tag is written to your lock-file (composer.lock) if you:

1. run composer update [<package>]

... or ...

2. run composer install with a composer.json present but not a lock-file in composer's current directory which does auto-generate the lock-file