update composer.json/lock; moved preloaded to -dev.