Updates composer.lock hash without updating any packages
composer update --lock
composer require vendor/package:version
composer require 'vendor/package:version'
composer require vendor/package "version"
composer require vendor/package "1.x-dev"
composer require vendor/package "^1.2"
# For Drupal:
# 1.x is the version of the package, not the version of drupal.
# So for a dev package of "8.x-2.x-dev" just use "2.x-dev"
composer require vendor/package "1.x-dev"
https://semver.mwl.be/#?package=drupal%2Fcore&version=~8.6.0&minimum-stability=stable