See #34 (comment)

When using Travis CI or using a deployment tool such as Capifony/Capistrano (or whenever installing dependencies for the first time), the plugin runs a composer update after your composer install, causing any newer versions to be installed (contrary to what's in your lock file).

As it stands, a second composer install has to be run to force it back to the expected state.