Why does "composer create-project" install an outdated version of a lower level dependency?

I have two projects: one is a starter project for bootstrapping the second one ie I have a framework called Suphle and its user-facing starter project. The starter project requires suphle using a wildcard version.

In the past, suphle had a command with a compulsory flag. Along the line, the flag was made optional but every time someone installs it through the starter project, it still pulls the archaic version that will cause command to fail without that flag. The issue goes away after running composer update. So my question is why isn’t the most recent version of suphle detected and how do I rectify this without hard-coding the latest tag?

Here is the composer.json for the starter project

{
    "name": "nmeri/suphle-starter",
    "type": "project",
    "description": "Setup Suphle folder structure and provide workers or entry scripts for handling incoming requests",
    "autoload": {
        "psr-4": {
            "AllModules\\": "AllModules/",
            "AppModels\\": "AppModels/",
            "ModuleInteractions\\": "ModuleInteractions/"
        }
    },
    "config": {
        "sort-packages": true
    },
    "require": {
        "nmeri/suphle": "*"
    },
    "require-dev": {},
    "scripts": {
        "post-create-project-cmd": [
            "rr get-binary --location=./vendor/bin"
        ]
    }
}

>Solution :

first guess:

you checked in the composer.lock file. if you run composer install, it takes the information from the lock file, not the composer.json. to check why a version is installed, you can call composer why.

to fix this, you should just delete the composer.lock file and remove it from the code repository (and ignore it in .gitignore).

so at the first setup, composer install see there is no lock file and creates a new one (which is ignored by git afterwards).