The behavior is different depending on whether or not there is a composer.lock file in the same hierarchy.
If the composer.lock file does not exist
Look at composer.json and install the latest version of the package listed.
After installation, a composer.lock is created.
The composer.lock contains information about the packages you have installed.
Same as composer install
If you have a composer.lock file
Look at composer.lock and install the listed version of the package Do.
It has the advantage that no matter who runs the install command in any environment, as long as there is a lock file, the version of the package to be installed is fixed.
Look at composer.json and make sure you have the latest version of the packages listed in Installation.
You can delete the composer.lock file and install the composer and Equivalent treatment.