之前也有遇到，結果 Lorna Jane Mitchell 寫了一篇「Handling Composer "lock file out of date" Warning」給了不少解法。
第一種是 composer upgrade，直接全部升級。
第二種是先用 composer update --dry-run 看看是不是有人加到 composer.json 後忘記更新，如果是的話再用 composer update [package] 處理。
第三種是用 composer update nothing 閉上眼睛更新 hash 值，當作什麼都沒看到 XDDD
Sometimes this is the right answer so it's a handy trick to know!. I seem to see these kinds of issues in people's projects quite often (I'm a consultant, I see a lot of projects) so I thought I'd share my usual tactics for getting things sorted - if you have any tricks of your own to share, I'd love to hear them :)
該說很「實用」嗎 XDDD