Before Redmine 4.2.0, members box of the project overview page did not display locked users, but it does in Redmine 4.2.0.

I think it is a bug due to #33174. In the change, the method to list members has been changed from @Project#members@ to @Project#memberships@ to get not only users but also groups. However, @Project#members@ only returns active users but @Project#memberships@ does not check the status of users/groups.

  has_many :memberships, :class_name => 'Member', :inverse_of => :project
  # Memberships of active users only
  has_many :members,
           lambda {joins(:principal).where(:users => {:type => 'User', :status => Principal::STATUS_ACTIVE})}

I think @Project#principals_by_role@ that prepares values for the members box by using @Project#memberships@ should exclude locked users.

Redmine 4.1:
!{width: 600px; border: 1px solid grey;}.4_1.png!

Redmine 4.2:
!{width: 600px; border: 1px solid grey;}.4_2.png!