Composer packages changed, even though same version used I'm sorry, but in my project, composer update is changing files in my vendor directory even though I'm getting the exact same version of the libraries before &amp; after.  I just want to ask, is this because the packages on packagist are changing, like a branch which is receiving new commits?  Or, is it that something is going wrong in my project?

I thought that if you use composer.lock to keep the versions exactly the same, no files should be changed.

We have kept our libraries versioned, is it possible that a developer modified them incorrectly?
composer update without any argument tries to update everything.

If you want to use the packages specified in composer.lock, run composer install instead.