Lorna Jane Mitchell explains on her blog which options you have when you see "lock file out of date" warning.
The `composer.lock` also includes a hash of the current `composer.json` when it updates, so you can always tell if you've added a requirement to the `composer.json` file and forgotten to install it.http://www.lornajane.net/posts/2016/handling-composer-lock-file-out-of-date-warning
In that case, you'll see an error message like:Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. Run update to update them.
You now have three options: upgrade everything, figure it out, or do nothing.