update composer lock and manifest