PHPUnit lock file is not up to date with composer.json

[asispts]

Symfony version(s) affected

6.3

Description

When running bin/phpunit install, I encountered this error:

No composer.json found in the current directory, showing available packages from packagist.org
Creating a "phpunit/phpunit" project at "./phpunit-9.6-0"
Installing phpunit/phpunit (9.6.14)
Plugins have been disabled.
  - Installing phpunit/phpunit (9.6.14): Extracting archive
Created project in /var/www/html/vendor/bin/.phpunit/phpunit-9.6-0
composer.json has been updated
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. It is recommended that you run `composer update` or `composer update <package name>`.
- Required package "symfony/phpunit-bridge" is not present in the lock file.

I think this error is caused by the script adding "symfony/phpunit-bridge": "*@dev" to phpunit's composer.json.

Additional Context

symfony/phpunit-bridge: ^6.3.8 with the latest recipes

[xabbuh]

I guess this is caused by the latest PHPUnit versions shipping the composer.lock file. Thus we need to run composer update instead of composer install (see #52846 for the fix).

In the meantime you can enforce an older PHPUnit version with the SYMFONY_PHPUNIT_VERSION environment variable like this:

SYMFONY_PHPUNIT_VERSION=9.6.13 php ./phpunit install