Thanks @greg.1.anderson, I am not sure if I understand. However, I still thin...

Thanks @greg.1.anderson, I am not sure if I understand. However, I still think that the changes in #72 (and hence #83) are necessary. IIRC, I got the changes just by running `composer install`. I'm trying to check my history to see if I ran something else but after that, the lock file was updated with the correct constraints for composer-plugin-api under `drupal/core-project-message` and `drupal/core-vendor-hardening`.