A workaround which works for me (on many servers). Rename the field composer.lock to composer.lock.bkp, do the upgrade, it will rebuild it with a release.
You can do first a backup if you are affraid
yunohost create backup --apps roundcube
mv /var/www/roundcube/composer.lock /var/www/roundcube/composer.lock .bkp
yunohost app upgrade roundcube
After if it works, you can remove the field renamed.
rm /var/www/roundcube/composer.lock.bkp