Running sync.sh will include unwanted updates on unrelated composer packages.
It seems that at the very end of the sync.sh the composer.lock file is not respected and brings in a bunch of updates from the composer-merge-plugin.
Dependency resolution completed in 0.001 seconds Lock file operations: 0 installs, 4 updates, 0 removals Updates: league/oauth2-server:dev-v9.0.0-alpha 58fdace, php-http/httplug:2.3.0, nyholm/psr7:1.5.0, professional-wiki/edtf:2.0.1 - Upgrading league/oauth2-server (dev-v9.0.0-alpha 61d770d => dev-v9.0.0-alpha 58fdace) - Upgrading nyholm/psr7 (1.4.1 => 1.5.0) - Upgrading php-http/httplug (2.2.0 => 2.3.0) - Upgrading professional-wiki/edtf (2.0.0 => 2.0.1)