Symfony/mailer in composer.json / composer.lock where to see version?

Question

After installing symfony/mailer I got an entry like this in composer.json

require: {
  "symfony/mailer": "*",
  ...
}

only occurrence in composer.lock is here:

 "replace": {
                "symfony/mailer": "self.version",
    ...
 }

no, there is NO other occurrence of symfony/mailer in composer.lock

what version is it? if I upgrade symfony, I sense that symfony will silently upgrade the package too, and create issues without me noticing. It seems to smell like bad design.