The composer.lock strikes back