How to exclude contributed modules from being upgraded when we run composer install or composer update?
In composer.json, you remove the ^ and specify the version
Ex: Normally most modules are like this:
&quot;require&quot;: {
    &quot;drupal/commerce: &quot;^2.21&quot;,
},

and to lock it, you change to
&quot;require&quot;: {
    &quot;drupal/commerce: &quot;2.20&quot;, // will always install version 2.20 and never update.
},

But because Ubercart is in Alpha, you'll see its currently
&quot;require&quot;: {
    &quot;drupal/ubercart: &quot;^4.0@alpha&quot;,
},

And to lock needs to be
&quot;require&quot;: {
    &quot;drupal/ubercart&quot;: &quot;4.0-alpha3&quot;, // will always install alpha 3 and never update.
},