fix dependencies, add composer.lock

ah, /this/ is why it's a good idea to have composer.lock in your repo