title: Composer generates incorrect composer.lock after composer update
body: <p>My <code>composer.json</code>:</p>
  
  <pre><code>{
      "name": "laravel/laravel",
      "description": "The Laravel Framework.",
      "keywords": ["framework", "laravel"],
      "license": "MIT",
      "type": "project",
      "require": {
          "php": "&gt;=7.1.3",
          "darkaonline/l5-swagger": "5.6.*",
          "fideloper/proxy": "~4.0",
          "laravel/framework": "5.6.*",
          "laravel/passport": "^5.0",
          "laravel/tinker": "~1.0",
          "predis/predis": "^1.1",
          "spatie/laravel-permission": "^2.9"
      },
      "require-dev": {
          "filp/whoops": "~2.0",
          "fzaninotto/faker": "~1.4",
          "mockery/mockery": "~1.0",
          "nunomaduro/collision": "~1.1",
          "phpunit/phpunit": "~7.0",
          "reliese/laravel": "^0.0.13",
          "symfony/thanks": "^1.0",
          "xethron/migrations-generator": "^2.0"
      },
      "autoload": {
          "classmap": [
              "database/seeds",
              "database/factories"
          ],
          "psr-4": {
              "App\\": "app/"
          }
      },
      "autoload-dev": {
          "psr-4": {
              "Tests\\": "tests/"
          }
      },
      "extra": {
          "laravel": {
              "dont-discover": [
              ]
          }
      },
      "scripts": {
          "post-root-package-install": [
              "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
          ],
          "post-create-project-cmd": [
              "@php artisan key:generate"
          ],
          "post-autoload-dump": [
              "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
              "@php artisan package:discover"
          ]
      },
      "config": {
          "preferred-install": "dist",
          "sort-packages": true,
          "optimize-autoloader": true
      },
      "minimum-stability": "dev",
      "prefer-stable": true
  }
  </code></pre>
  
  <p>Output of <code>composer diagnose</code>:</p>
  
  <pre><code>Checking composer.json: OK
  Checking platform settings: OK
  Checking git settings: OK
  Checking http connectivity to packagist: OK
  Checking https connectivity to packagist: OK
  Checking github.com rate limit: OK
  Checking disk free space: OK
  Checking pubkeys: FAIL
  Missing pubkey for tags verification
  Missing pubkey for dev verification
  Run composer self-update --update-keys to set them up
  Checking composer version: OK
  Composer version: 1.6.3
  PHP version: 7.2.2-3+ubuntu14.04.1+deb.sury.org+1
  PHP binary path: /usr/bin/php7.2
  </code></pre>
  
  <p>When I run this command:</p>
  
  <pre><code>composer update
  </code></pre>
  
  <p>I get the following output:</p>
  
  <pre><code>ATTENTION! Big file ~5k lines, the composer.lock
  https://pastebin.com/1Jc1HqRj
  </code></pre>
  
  <p>And I expected this to happen:
  The predis/predis package should be at the "require" section of the composer.lock, not in "require-dev".
  So, how to move it from the composer .lock's require-dev section to the simple require? I use Heroku and need it in to the simple "require" section in the composer.lock.
  Thank you.</p>