update composer.json/lock, again