don't check composer.lock