update composer.lock changes:

$ composer update picocms/pico picocms/pico-theme picocms/pico-deprecated

Output:
Loading "picocms/composer-installer" which is a legacy composer-installer built for Composer 1.x, it is likely to cause issues as you are running Composer 2.x.
Composer is operating significantly slower than normal because you do not have the PHP curl extension enabled.
Loading composer repositories with package information
Info from https://repo.packagist.org: #StandWithUkraine
Updating dependencies
Lock file operations: 0 installs, 3 updates, 0 removals
  - Upgrading picocms/pico (dev-pico-3.0 a5fefa4 => dev-pico-3.0 efa51f6)
  - Upgrading picocms/pico-deprecated (dev-pico-3.0 ccf1194 => dev-pico-3.0 38c788d)
  - Upgrading picocms/pico-theme (dev-pico-3.0 f322a0b => dev-pico-3.0 b648e93)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 3 updates, 0 removals
  - Downloading picocms/pico (dev-pico-3.0 efa51f6)
  - Downloading picocms/pico-deprecated (dev-pico-3.0 38c788d)
  - Downloading picocms/pico-theme (dev-pico-3.0 b648e93)
  - Upgrading picocms/pico (dev-pico-3.0 a5fefa4 => dev-pico-3.0 efa51f6): Extracting archive
  - Upgrading picocms/pico-deprecated (dev-pico-3.0 ccf1194 => dev-pico-3.0 38c788d): Extracting archive
  - Upgrading picocms/pico-theme (dev-pico-3.0 f322a0b => dev-pico-3.0 b648e93): Extracting archive
Package phpunit/php-token-stream is abandoned, you should avoid using it. No replacement was suggested.