allow the composer lock

commit the composer lock to ensure we know which versions are dependent.