Return to Answer

Remove "preferred-install": "source" from config or set it to "dist".
Putting "source" means Composer will get a package from a version control repository. And it seems to be downloading directly from https://git.drupalcode.org where all projects have no fixed version in their info files no matter which Git tag you check out.

You also can set more advanced patterns, check https://getcomposer.org/doc/06-config.md#preferred-install. In your case it probably can be boiled down to the following.

{ "config": { "preferred-install": { "drupal/*": "source", "*": "dist" } } } 

Then remove vendor/, remove lock and reinstall. rm -rf vendor/ && rm composer.lock && composer install.

Remove "preferred-install": "source" from config or set it to "dist".
Putting "source" means Composer will get a package from a version control repository. And it seems to be downloading directly from https://git.drupalcode.org where all projects have no fixed version in their info files no matter which Git tag you check out.

You also can set more advanced patterns, check https://getcomposer.org/doc/06-config.md#preferred-install. In your case it probably can be boiled down to the following.

{ "config": { "preferred-install": { "drupal/*": "dist", "*": "source" } } } 

Then remove vendor/, remove the lock file and reinstall. rm -rf vendor/ && rm composer.lock && composer install.

Remove "preferred-install": "source" from config or set it to "dist".
Putting "source" means Composer will get a package from a version control repository. And it seems to be downloading directly from https://git.drupalcode.org where all projects have no fixed version in their info files no matter which Git tag you check out.

You also can set more advanced patterns, check https://getcomposer.org/doc/06-config.md#preferred-install. In your case it probably can be boiled down to the following.

{ "config": { "preferred-install": { "drupal/*": "source", "*": "dist" } } } 

Remove "preferred-install": "source" from config or set it to "dist".
Putting "source" means Composer will get a package from a version control repository. And it seems to be downloading directly from https://git.drupalcode.org where all projects have no fixed version in their info files no matter which Git tag you check out.

You also can set more advanced patterns, check https://getcomposer.org/doc/06-config.md#preferred-install. In your case it probably can be boiled down to the following.

{ "config": { "preferred-install": { "drupal/*": "source", "*": "dist" } } } 

Then remove vendor/, remove lock and reinstall. rm -rf vendor/ && rm composer.lock && composer install.

Remove "preferred-install": "source" from config or set it to "dist".
Putting "source" means Composer will get a package from a version control repository. You also can set more advanced patterns, check https://getcomposer.org/doc/06-config.md#preferred-install.
In your case it probably can be boiled down to the following.

{ "config": { "preferred-install": { "drupal/*": "source", "*": "dist" } } } 

Remove "preferred-install": "source" from config or set it to "dist".
Putting "source" means Composer will get a package from a version control repository. And it seems to be downloading directly from https://git.drupalcode.org where all projects have no fixed version in their info files no matter which Git tag you check out.

You also can set more advanced patterns, check https://getcomposer.org/doc/06-config.md#preferred-install. In your case it probably can be boiled down to the following.

{ "config": { "preferred-install": { "drupal/*": "source", "*": "dist" } } }