Composer.lock does not match project versions

Question

I have a drupal site developed using the core-recommended project, and I maintain the site using the recommended practices on drupal.org.

Recently after adding a new developer to the project, Composer is now showing the wrong versions of modules and not updating them.

For example, with the Font Awesome module:

1. Composer.lock shows version 2.26 is installed.
2. composer info drupal/fontawesome shows 2.26 and displays the correct path under /web/modules/contrib/fontawesome
3. But /web/modules/contrib/fontawesome/fontawesome.info.yml shows version 2.25
4. Even worse, /vendor/drupal/fontawesome/fontawesome.info.yml shows version 2.23
5. composer install --dry-run returns "Nothing to install, update or remove"

I've tried searching the web for this issue and have so far come up empty.

I've also tried deleting the composer.lock file and running a fresh composer install but it ends up in the same state afterwards.

Has anyone run into this problem, or have an idea how to fix it?

Edit to add my composer.json:

{
    "name": "drupal/recommended-project",
    "description": "Project template for Drupal 9 projects with a relocated document root",
    "type": "project",
    "license": "GPL-2.0-or-later",
    "homepage": "https://www.drupal.org/project/drupal",
    "support": {
        "docs": "https://www.drupal.org/docs/user_guide/en/index.html",
        "chat": "https://www.drupal.org/node/314178"
    },
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        }
    ],
    "require": {
        "composer/installers": "^1.9",
        "drupal/block_class": "^2.0",
        "drupal/colorbox": "^2.0",
        "drupal/core-composer-scaffold": "^9.2",
        "drupal/core-project-message": "^9.2",
        "drupal/core-recommended": "^9.2",
        "drupal/entity_embed": "^1.4",
        "drupal/file_browser": "^1.3",
        "drupal/filefield_sources": "^1.0@alpha",
        "drupal/fontawesome": "^2.19",
        "drupal/google_analytics": "^4.0",
        "drupal/google_api_client": "^4.0",
        "drupal/google_cse": "^3.7",
        "drupal/honeypot": "^2.0",
        "drupal/ldap": "^4.2",
        "drupal/metatag": "^1.22",
        "drupal/pathauto": "^1.8",
        "drupal/redirect": "^1.6",
        "drupal/restrict_ip": "^4.0@beta",
        "drupal/site_alert": "^1.2",
        "drupal/token": "^1.9",
        "drupal/webform": "^6.1",
        "drupal/webform_googlesheets": "^2.0",
        "drupal/wysiwyg_mediaembed": "^1.0@alpha",
        "drush/drush": "^10.6",
        "wikimedia/composer-merge-plugin": "^2.0"
    },
    "conflict": {
        "drupal/drupal": "*"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "sort-packages": true,
        "allow-plugins": {
            "composer/installers": true,
            "drupal/core-composer-scaffold": true,
            "drupal/core-project-message": true,
            "wikimedia/composer-merge-plugin": true
        }
    },
    "extra": {
        "drupal-scaffold": {
            "locations": {
                "web-root": "web/"
            }
        },
        "installer-paths": {
            "web/core": [
                "type:drupal-core"
            ],
            "web/libraries/{$name}": [
                "type:drupal-library"
            ],
            "web/modules/contrib/{$name}": [
                "type:drupal-module"
            ],
            "web/profiles/contrib/{$name}": [
                "type:drupal-profile"
            ],
            "web/themes/contrib/{$name}": [
                "type:drupal-theme"
            ],
            "drush/Commands/contrib/{$name}": [
                "type:drupal-drush"
            ],
            "web/modules/custom/{$name}": [
                "type:drupal-custom-module"
            ],
            "web/profiles/custom/{$name}": [
                "type:drupal-custom-profile"
            ],
            "web/themes/custom/{$name}": [
                "type:drupal-custom-theme"
            ]
        },
        "drupal-core-project-message": {
            "include-keys": [
                "homepage",
                "support"
            ],
            "post-create-project-cmd-message": [
                "<bg=blue;fg=white>                                                         </>",
                "<bg=blue;fg=white>  Congratulations, you’ve installed the Drupal codebase  </>",
                "<bg=blue;fg=white>  from the drupal/recommended-project template!          </>",
                "<bg=blue;fg=white>                                                         </>",
                "",
                "<bg=yellow;fg=black>Next steps</>:",
                "  * Install the site: https://www.drupal.org/docs/8/install",
                "  * Read the user guide: https://www.drupal.org/docs/user_guide/en/index.html",
                "  * Get support: https://www.drupal.org/support",
                "  * Get involved with the Drupal community:",
                "      https://www.drupal.org/getting-involved",
                "  * Remove the plugin that prints this message:",
                "      composer remove drupal/core-project-message"
            ]
        },
        "merge-plugin": {
            "include": [
                "web/modules/contrib/webform/composer.libraries.json"
            ]
        }
    }
}