Use --locked to ensure package info is read from composer.lock

[jorgetutor]

If composer install has not been executed or any package is changed/removed from vendor folder it will display wrong information.