6baed1b439f624b5c130766419bae85531b23dbd removed the dependency from the `composer.json` but not from the `composer.lock`. This causes different results when executing `composer install` vs. `composer update` in the extension directory. We discovered this during handling CVE-2025-54370 (which is for `phpoffice/phpspreadsheet`). Actually, I think the `composer.lock` shouldn't be part of the repo in the first place.