While working on MDL-52685, it was realised that composer download packages depending on which php version "php composer.phar install" is executed. But if composer.lock is preset (which is shipped with moodle), then only versions specified in composer.lock are installed.

As there has been a big difference in php5 and php7 it is good time to reconsider an alternative to shipping composer.lock, so composer can install the proper packages for the php version it is running.

Currently no issue has been reported but in long term it can lead to problems.