Issue #3265874: Do not allow apply if active and staged composer locks are identical.

package_manager/src/Validator/LockFileValidator.php

@@ -116,12 +116,15 @@ class LockFileValidator implements PreOperationStageValidatorInterface {
       $error = $this->t('Stored lock file hash does not match the active lock file.');
     }
 
+    // Don't allow staged changes to be applied if the staged lock file has no
+    // apparent changes.
     if (empty($error) && $event instanceof PreApplyEvent) {
       $stage_hash = $this->getLockFileHash($event->getStage()->getStageDirectory());
-      if ($active_hash === $stage_hash) {
+      if (hash_equals($active_hash, $stage_hash)) {
         $error = $this->t('There are no pending Composer operations.');
       }
     }
+
     // @todo Let the validation result carry all the relevant messages in
     //   https://www.drupal.org/i/3247479.
     if (isset($error)) {