composer.lock unchanged; vendorHash moves with the version (embedded in vendor/composer/installed.*).