If there is a "composer.lock" file in the current directory, it will use the exact versions from there instead of resolving them. This ensures that everyone using the library will get the same versions of the dependencies.
If there is no "composer.lock" file, composer will create one after dependency resolution.