incorrect magento 2 version being installed on composer update

Question

I'm trying to install Magento 2.3.3 but for some reasons it keeps on installing 2.4.0. I tried clearing the composer cache and reinstalling everything(delete vendor and composer.lock). but it always install 2.4.0 every time I run a composer update. here's my composer.json

"require": {
    "magento/product-community-edition": "^2.3.3",
    "adyen/module-payment": "^2.1",
    "magento/data-migration-tool": "^2.3.1",
    "zendframework/zend-stdlib": "~3.2.1",
    "zendesk/zendesk_api_client_php": "^2.2"
},
"require-dev": {
    "allure-framework/allure-phpunit": "~1.2.0",
    "friendsofphp/php-cs-fixer": "~2.14.0",
    "lusitanian/oauth": "~0.8.10",
    "magento/magento-coding-standard": "~3.0.0",
    "magento/magento2-functional-testing-framework": "2.4.5",
    "pdepend/pdepend": "2.5.2",
    "phpmd/phpmd": "@stable",
    "phpunit/phpunit": "~6.5.0",
    "sebastian/phpcpd": "~3.0.0",
    "squizlabs/php_codesniffer": "~3.4.0"
},

does anyone have an idea why this is happening? 2.4.0 is quite unstable and I don't want to use it yet.

running php bin/mangeto --version return 2.4.0

same when checking composer.lock

Answer 1

As stated in the comments, you should use

"magento/product-community-edition": "2.3.3",

instead of

"magento/product-community-edition": "^2.3.3",

Explanations can be found here: https://getcomposer.org/doc/articles/versions.md#caret-version-range-

Caret Version Range (^)
The ^ operator behaves very similarly, but it sticks closer to semantic versioning, and will always allow non-breaking updates. For example ^1.2.3 is equivalent to >=1.2.3 <2.0.0 as none of the releases until 2.0 should break backwards compatibility. For pre-1.0 versions it also acts with safety in mind and treats ^0.3 as >=0.3.0 <0.4.0.
This is the recommended operator for maximum interoperability when writing library code.

So in your case ^2.3.3 is equivalent to >=2.3.3 and <3.0.0. Since there is a 2.4.0 version available that falls into the interval above, that one gets installed.