Lock composer dependencies