add composer.lock, so all install the same