composer lock and json