Lock dependecies with composer